CVE-2024-0229
Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.
| CWE | CWE-787 |
| Published | Feb 9, 2024 |
| Last Updated | Nov 6, 2025 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new high vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Red Hat / Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 7
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 8
All versions affected Red Hat / Red Hat Enterprise Linux 8.2 Advanced Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8.2 Telecommunications Update Service
All versions affected Red Hat / Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8.4 Telecommunications Update Service
All versions affected Red Hat / Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
All versions affected Red Hat / Red Hat Enterprise Linux 8.6 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 8.8 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9
All versions affected Red Hat / Red Hat Enterprise Linux 9.0 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Support
All versions affected Red Hat / Red Hat Enterprise Linux 6
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0320 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0557 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0558 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0597 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0607 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0614 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0617 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0621 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0626 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:0629 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:2169 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:2170 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:2995 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:2996 access.redhat.com: https://access.redhat.com/errata/RHSA-2025:12751 access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-0229 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2256690 lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/IZ75X54CN4IFYMIV7OK3JVZ57FHQIGIC/ lists.debian.org: https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/EJBMCWQ54R6ZL3MYU2D2JBW6JMZL7BQW/ lists.fedoraproject.org: https://lists.fedoraproject.org/archives/list/[email protected]/message/5J4H7CH565ALSZZYKOJFYDA5KFLG6NUK/
Credits
Upstream acknowledges Jan-Niklas Sohn (Trend Micro Zero Day Initiative) as the original reporter.