CVE-2022-46340
Published: 14 December 2022
A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.
Notes
| Author | Note |
|---|---|
| mdeslaur | xorg server is actually the xorg-server package the xorg package only contains docs xwayland package contains parts of xorg-server This is ZDI-CAN-19265 |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
xorg-server Launchpad, Ubuntu, Debian |
kinetic |
Released
(2:21.1.4-2ubuntu1.3)
|
| lunar |
Released
(2:21.1.5-1ubuntu1)
|
|
| upstream |
Needs triage
|
|
| trusty |
Released
(2:1.15.1-0ubuntu2.11+esm7)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| xenial |
Released
(2:1.18.4-0ubuntu0.12+esm5)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| bionic |
Released
(2:1.19.6-1ubuntu4.13)
|
|
| focal |
Released
(2:1.20.13-1ubuntu1~20.04.5)
|
|
| jammy |
Released
(2:21.1.3-2ubuntu2.5)
|
|
|
xorg-server-hwe-18.04 Launchpad, Ubuntu, Debian |
bionic |
Released
(2:1.20.8-2ubuntu2.2~18.04.9)
|
| trusty |
Does not exist
|
|
| xenial |
Does not exist
|
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
xorg-server-lts-wily Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
xorg-server-lts-xenial Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| trusty |
Ignored
(end of standard support)
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
xwayland Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| focal |
Does not exist
|
|
| jammy |
Released
(2:22.1.1-1ubuntu0.4)
|
|
| kinetic |
Released
(2:22.1.3-2ubuntu0.2)
|
|
| lunar |
Released
(2:22.1.6-1)
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
|
xorg-server-hwe-16.04 Launchpad, Ubuntu, Debian |
trusty |
Does not exist
|
| bionic |
Does not exist
|
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(2:1.19.6-1ubuntu4.1~16.04.6+esm4)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
|
xorg-server-lts-utopic Launchpad, Ubuntu, Debian |
trusty |
Ignored
(end of standard support)
|
| xenial |
Does not exist
|
|
| bionic |
Does not exist
|
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
xorg-server-lts-vivid Launchpad, Ubuntu, Debian |
trusty |
Ignored
(end of standard support)
|
| xenial |
Does not exist
|
|
| bionic |
Does not exist
|
|
| focal |
Does not exist
|
|
| jammy |
Does not exist
|
|
| kinetic |
Does not exist
|
|
| upstream |
Needs triage
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.8 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |