CVE-2024-0229

Public on 2024-01-18
Modified on 2024-10-23
Description
An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.
Severity
Important severity
Important
CVSS v3 Base Score
8.4
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 xorg-x11-server 2024-04-25 ALAS-2024-1932 Fixed
Amazon Linux 2 - Core xorg-x11-server 2024-02-15 ALAS2-2024-2455 Fixed
Amazon Linux 2023 xorg-x11-server 2024-02-15 ALAS2023-2024-522 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H