CVE-2022-3551: debian debian_linux Improper Resource Shutdown or Release
Vulnerability summary
CVE-2022-3551 is a medium (CVSS 6.5) Improper Resource Shutdown or Release vulnerability in debian debian_linux. EPSS estimates a 2.39% chance of exploitation in the next 30 days, higher than 83.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 19 · Related 11Timeline
- 17-10-2022PublishedVulnerability first disclosed.
- 15-04-2025Last modifiedVulnerability information updated.
Description
A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
2.39%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
+0.53 pp
From 1.86% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Affected systems
Ubuntu4 products
- xorg-server< 2:1.15.1-0ubuntu2.11+esm6 | < 2:1.18.4-0ubuntu0.12+esm4 | < 2:1.19.6-1ubuntu4.12 | < 2:1.20.13-1ubuntu1~20.04.4 | < 2:21.1.3-2ubuntu2.3
- xorg-server-hwe-16.04< 2:1.19.6-1ubuntu4.1~16.04.6+esm3
- xorg-server-hwe-18.04< 2:1.20.8-2ubuntu2.2~18.04.8
- xwayland< 2:22.1.1-1ubuntu0.3
Debian3 products
- xorg-server< 2:21.1.4-3
- xwayland< 2:22.1.5-1
- debian_linuxEOL10.0 | 11.0
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
4 vendors · 10 products
References
13 links- cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2Mailing ListPatchVendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.gentoo.org/glsa/202305-30Vendor Advisory