CVE-2017-2624: debian debian_linux Covert Timing Channel
Vulnerability summary
CVE-2017-2624 is a high (CVSS 7.0) Covert Timing Channel vulnerability in debian debian_linux. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.2% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.
CVSS metrics
5 scores · 4 sources · 2 versions- CVE.orgCNA5.9MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated7.0HighCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.70%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
+0.03 pp
From 0.67% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (x41-dsec.de)
Maturity: unknown
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-385Covert Timing ChannelCovert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Suse5 products
- xorg-x11-server&distro=SUSE Linux Enterprise Desktop 12 SP2< 7.6_1.18.3-71.1
- xorg-x11-server&distro=SUSE Linux Enterprise Server 12 SP2< 7.6_1.18.3-71.1
- xorg-x11-server&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 7.6_1.18.3-71.1
- xorg-x11-server&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 7.6_1.18.3-71.1
- xorg-x11-server&distro=SUSE Linux Enterprise Software Development Kit 12 SP2< 7.6_1.18.3-71.1
Ubuntu3 products
- xorg-server< 2:1.15.1-0ubuntu2.9 | < 2:1.18.4-0ubuntu0.3
- xorg-server-hwe-16.04< 2:1.18.4-1ubuntu6.1~16.04.2
- xorg-server-lts-xenial< 2:1.18.3-1ubuntu2.3~trusty2
Debian2 products
- xorg-server< 2:1.19.2-1
- debian_linuxEOL7.0
X.org2 products
- x_server≤ 1.19.4
- xorg-x11-server1.19.0
Mageia1 product
- nx< 3.5.0.33-1.mga6
5 vendors · 13 products
References
26 links- gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627cX Refsource CONFIRMPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2017/11/msg00032.htmlMailing ListX Refsource MLISTThird Party Advisory- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624X Refsource CONFIRMExploitIssue TrackingThird Party Advisory