CVE-2022-2320: x.org x_server Out-of-bounds Write
Vulnerability summary
CVE-2022-2320 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in x.org x_server. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 17 · Related 10Timeline
- 01-09-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of root.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.63% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu4 products
- xorg-serverAll versions (No fix recorded) | < 2:1.18.4-0ubuntu0.12+esm2 | < 2:1.19.6-1ubuntu4.11 | < 2:1.20.13-1ubuntu1~20.04.3 | < 2:21.1.3-2ubuntu2.1
- xorg-server-hwe-16.04< 2:1.19.6-1ubuntu4.1~16.04.6+esm1
- xorg-server-hwe-18.04< 2:1.20.8-2ubuntu2.2~18.04.7
- xwayland< 2:22.1.1-1ubuntu0.1
Debian2 products
- xorg-server< 2:21.1.4-1
- xwayland< 2:22.1.3-1
X.org1 product
- x_server21.1.0
3 vendors · 7 products
References
13 links- github.com/freedesktop/xorg-xserver/commit/dd8caf39e9e15d8f302e54045dd08d8ebf1025dcPatchThird Party Advisory
- security.netapp.com/advisory/ntap-20221104-0003/Third Party Advisory
