PT-2024-7643 · X.Org+11 · X.Org Server+11
Jan-Niklas Sohn
·
Published
2024-10-08
·
Updated
2025-06-17
·
CVE-2024-9632
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
X.Org Server versions prior to 21.1.14
Description
A flaw was found in the X.org server due to improperly tracked allocation size in
XkbSetCompatMap, allowing a local attacker to trigger a buffer overflow condition via a specially crafted payload. This can lead to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges. The issue is estimated to have been present for 18 years, affecting various Linux distributions and potentially other systems.Recommendations
For X.Org Server versions prior to 21.1.14, update to version 21.1.14 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
XkbSetCompatMap function until a patch is available. Additionally, ensure that the X.org server is not run with root privileges unless necessary, to minimize the risk of exploitation.Fix
DoS
LPE
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
X.Org Server