CVE-2023-0494: fedoraproject fedora Use After Free

CVSS: 7.8v3.1HighModified

AliasesMGASA-2023-0118SUSE-SU-2023:0282-1SUSE-SU-2023:0284-1+20 more

Published 27-03-2023Last modified 24-02-2025

Vulnerability summary

CVE-2023-0494 is a high (CVSS 7.8) Use After Free vulnerability in fedoraproject fedora. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 58.9% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

0.90%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 1

RHSA-2023:2248 RHSA-2023:2249 RHSA-2023:2805 RHSA-2023:2806 RHSA-2025:12751 USN-5778-2

Timeline

27-03-2023
PublishedVulnerability first disclosed.
24-02-2025
Last modifiedVulnerability information updated.

Description

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

CVSS metrics

5 scores · 5 sources · 1 version

v3.17.8

EPSS trend

Probability

0.90%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

0.00 pp

From 0.90% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.90%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Redhat40 products

enterprise_linux8.0 | 8.1 | 9.0
enterprise_linux_aus8.4 | 8.6
enterprise_linux_desktop7.0
enterprise_linux_eus8.4 | 8.6 | 9.0
enterprise_linux_for_ibm_z_systems7.0 | 8.0

enterprise_linux_for_ibm_z_systems_eus8.4 | 8.6
enterprise_linux_for_power_big_endian7.0
enterprise_linux_for_power_little_endian7.0 | 8.0 | 9.0
enterprise_linux_for_power_little_endian_eus8.4 | 8.6
enterprise_linux_for_scientific_computing7.0
enterprise_linux_server7.0
enterprise_linux_server_aus8.2
enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions8.1 | 8.2 | 8.4 | 8.6 | 9.0
enterprise_linux_server_tus8.2 | 8.4 | 8.6
enterprise_linux_server_update_services_for_sap_solutions8.2
enterprise_linux_server_workstation7.0
tigervnc< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-debuginfo< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-debugsource< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1
tigervnc-icons< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-license< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-selinux< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1
tigervnc-server< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-server-applet< 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-server-debuginfo< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1
tigervnc-server-minimal< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-server-minimal-debuginfo< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1
tigervnc-server-module< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1 | < 0:1.8.0-24.el7_9
tigervnc-server-module-debuginfo< 0:1.12.0-5.el9_1.1 | < 0:1.11.0-22.el9_0.1 | < 0:1.12.0-9.el8_7.1 | < 0:1.12.0-6.el8_6.1 | < 0:1.11.0-8.el8_4.1 | < 0:1.9.0-16.el8_1.1 | < 0:1.9.0-15.el8_2.1
xorg-x11-server< 0:1.20.4-22.el7_9
xorg-x11-server-common< 0:1.20.4-22.el7_9
xorg-x11-server-debuginfo< 0:1.20.4-22.el7_9
xorg-x11-server-devel< 0:1.20.4-22.el7_9
xorg-x11-server-source< 0:1.20.4-22.el7_9
xorg-x11-server-Xdmx< 0:1.20.4-22.el7_9
xorg-x11-server-Xephyr< 0:1.20.4-22.el7_9
xorg-x11-server-Xnest< 0:1.20.4-22.el7_9
xorg-x11-server-Xorg< 0:1.20.4-22.el7_9
xorg-x11-server-Xvfb< 0:1.20.4-22.el7_9
xorg-x11-server-Xwayland< 0:1.20.4-22.el7_9

Show all 40

Suse28 products

xorg-x11-server&distro=SUSE Enterprise Storage 7< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Enterprise Storage 7.1< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.20.3-150100.14.5.36.1
xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 1.20.3-150200.22.5.66.1

xorg-x11-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 1.20.3-150400.38.16.1
xorg-x11-server&distro=SUSE Linux Enterprise Module for Development Tools 15 SP4< 1.20.3-150400.38.16.1
xorg-x11-server&distro=SUSE Linux Enterprise Real Time 15 SP3< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 7.6_1.18.3-76.60.1
xorg-x11-server&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 1.19.6-4.42.1
xorg-x11-server&distro=SUSE Linux Enterprise Server 12 SP5< 1.19.6-10.43.1
xorg-x11-server&distro=SUSE Linux Enterprise Server 15 SP1-LTSS< 1.20.3-150100.14.5.36.1
xorg-x11-server&distro=SUSE Linux Enterprise Server 15 SP2-LTSS< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise Server 15 SP3-LTSS< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.19.6-4.42.1
xorg-x11-server&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.19.6-10.43.1
xorg-x11-server&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP1< 1.20.3-150100.14.5.36.1
xorg-x11-server&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP2< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP3< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.19.6-10.43.1
xorg-x11-server&distro=SUSE Linux Enterprise Workstation Extension 15 SP4< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Manager Proxy 4.2< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Manager Retail Branch Server 4.2< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE Manager Server 4.2< 1.20.3-150200.22.5.66.1
xorg-x11-server&distro=SUSE OpenStack Cloud 9< 1.19.6-4.42.1
xorg-x11-server&distro=SUSE OpenStack Cloud Crowbar 9< 1.19.6-4.42.1
xwayland&distro=SUSE Linux Enterprise Workstation Extension 15 SP4< 21.1.4-150400.3.9.1

Show all 28

Opensuse4 products

xorg-x11-server&distro=openSUSE Leap 15.4< 1.20.3-150200.22.5.66.1 | < 1.20.3-150400.38.16.1
xorg-x11-server&distro=openSUSE Tumbleweed< 21.1.7-1.1
xwayland&distro=openSUSE Leap 15.4< 21.1.4-150400.3.9.1
xwayland&distro=openSUSE Tumbleweed< 22.1.8-1.1

Ubuntu4 products

xorg-server< 2:1.15.1-0ubuntu2.11+esm7 | < 2:1.18.4-0ubuntu0.12+esm5 | < 2:1.19.6-1ubuntu4.14 | < 2:1.20.13-1ubuntu1~20.04.6 | < 2:21.1.3-2ubuntu2.7
xorg-server-hwe-16.04< 2:1.19.6-1ubuntu4.1~16.04.6+esm4
xorg-server-hwe-18.04< 2:1.20.8-2ubuntu2.2~18.04.10
xwayland< 2:22.1.1-1ubuntu0.5

Debian2 products

xorg-server< 2:21.1.7-1 | < 2:1.20.11-1+deb11u5 | < 2:1.20.4-1+deb10u8
xwayland< 2:22.1.8-1

Mageia2 products

tigervnc< 1.11.0-4.2.mga8
x11-server< 1.20.14-4.2.mga8

Fedoraproject1 product

fedoraEOL36 | 37

X.org1 product

x_server< 21.1.7

8 vendors · 82 products

References

47 links

bugzilla.redhat.com/show_bug.cgi?id=2165995REPORTIssue TrackingThird Party Advisory
lists.x.org/archives/xorg-announce/2023-February/003320.htmlWEBMailing ListVendor Advisory
gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ecPatch
security.gentoo.org/glsa/202305-30Vendor Advisory
advisories.mageia.org/MGASA-2023-0118.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=31523REPORT
access.redhat.com/errata/RHSA-2023:0622WEBAdvisory
lists.x.org/archives/xorg-announce/2023-February/003321.htmlWEB
lists.x.org/archives/xorg-announce/2023-February/003322.htmlWEB
lists.opensuse.org/archives/…WEB

Show all 47 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities