CVE-2022-46340

NameCVE-2022-46340
DescriptionA vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32 bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where the client and server use the same byte order.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3256-1, DSA-5304-1
Debian Bugs1026071

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xorg-server (PTS)buster2:1.20.4-1+deb10u4vulnerable
buster (security)2:1.20.4-1+deb10u7fixed
bullseye2:1.20.11-1+deb11u3vulnerable
bullseye (security)2:1.20.11-1+deb11u4fixed
bookworm, sid2:21.1.6-1fixed
xwayland (PTS)bookworm, sid2:22.1.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xorg-serversourcebuster2:1.20.4-1+deb10u7DLA-3256-1
xorg-serversourcebullseye2:1.20.11-1+deb11u4DSA-5304-1
xorg-serversource(unstable)2:21.1.5-11026071
xwaylandsource(unstable)2:22.1.6-1

Notes

https://lists.x.org/archives/xorg-announce/2022-December/003302.html
https://gitlab.freedesktop.org/xorg/xserver/commit/b320ca0ffe4c0c872eeb3a93d9bde21f765c7c63

Search for package or bug name: Reporting problems