PT-2022-7136 · X.Org+9 · X.Org+9
Jan-Niklas Sohn
·
Published
2022-11-21
·
Updated
2024-10-08
·
CVE-2022-46341
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
X.Org (affected versions not specified)
Description
A security flaw in X.Org occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. The vulnerability is related to the ProcXIPassiveUngrabDevice function and is associated with a buffer overflow, allowing a remote attacker to access confidential data, compromise their integrity, and cause a denial of service.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Suse
Ubuntu
X.Org