CVE-2021-3472: X.Org Server XChangeFeedbackControl Integer Underflow Privilege Escalation Vulnerability
A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
A vulnerability was found affecting X.Org-Server, where integer underflow exist in xserver, ProcXChangeFeedbackControl() leading to local privilege escalation
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xorg-serverto a version that resolves this vulnerability.Fixed in 2:1.20.4-1+deb10u4Fixed in 2:1.20.4-1+deb10u9Fixed in 2:1.20.11-1+deb11u6Fixed in 2:21.1.7-3Fixed in 2:21.1.8-1 - Upgrade
Upgrade
redhat/xorg-x11-serverto a version that resolves this vulnerability.Fixed in 1.20.11 - Upgrade
Upgrade
xorg-x11-serverto a version that resolves this vulnerability.Fixed in 1.20.11
Event History
Frequently Asked Questions
What is CVE-2021-3472?
CVE-2021-3472 is a vulnerability in X.Org Server that allows local attackers to escalate privileges on affected installations.
How does CVE-2021-3472 impact X.Org Server?
CVE-2021-3472 allows local attackers to escalate privileges on affected installations of X.Org Server.
What is the severity of CVE-2021-3472?
CVE-2021-3472 has a severity rating of high.
How can CVE-2021-3472 be exploited?
To exploit CVE-2021-3472, an attacker must first obtain the ability to execute low-privileged code on the target system.
What is the remedy for CVE-2021-3472?
The remedy for CVE-2021-3472 is to update X.Org Server to versions 2:1.20.4-1+deb10u4, 2:1.20.4-1+deb10u9, 2:1.20.11-1+deb11u6, 2:21.1.7-3, or 2:21.1.8-1.