CVE-2022-46340: High severity x.org xserver vulnerability
A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.
Other sources
CVE-2022-46340/ZDI-CAN-19265: X.Org Server XTestSwapFakeInput stack overflow
The swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request.
This issue does not affect systems where client and server use the same byte order.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-46340?
CVE-2022-46340 is a vulnerability in X.Org that occurs due to a stack corruption issue in the XTestFakeInput request of the XTest extension.
What is the severity of CVE-2022-46340?
The severity of CVE-2022-46340 is high with a CVSS score of 8.8.
Which software versions are affected by CVE-2022-46340?
The affected software versions include xorg-server versions 2:1.20.4-1+deb10u9, 2:1.20.11-1+deb11u6, 2:21.1.7-3, and 2:21.1.8-1.
How can I fix CVE-2022-46340?
To fix CVE-2022-46340, update xorg-server to versions 2:1.20.4-1+deb10u9, 2:1.20.11-1+deb11u6, 2:21.1.7-3, or 2:21.1.8-1.
Is Redhat Enterprise Linux vulnerable to CVE-2022-46340?
No, Redhat Enterprise Linux versions 6.0, 7.0, 8.0, and 9.0 are not vulnerable to CVE-2022-46340.