CVE-2022-46340
Published: 14 December 2022
Summary
CVE-2022-46340 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Redhat Enterprise Linux. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 20.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A vulnerability exists in the X.Org X server within the swap handler for the XTestFakeInput request of the XTest extension. When GenericEvents exceeding 32 bytes in length are processed, stack corruption can occur. The flaw is tracked as CWE-787 and carries a CVSS 3.1 score of 8.8. It affects X.Org-based systems, with impact limited to configurations where the X server runs with elevated privileges or where X11 forwarding over SSH is in use; systems with matching client and server byte order are unaffected.
An attacker with low privileges and network access can send a crafted XTestFakeInput request to trigger the corruption. Successful exploitation yields local privilege escalation on privileged X servers or remote code execution in SSH X-forwarding sessions, enabling full confidentiality, integrity, and availability impact.
Red Hat and Fedora have published security advisories and updated packages addressing the issue, available through their respective distribution channels.
The EPSS score for this CVE rose sharply from a low baseline to a peak of 0.3543 on 2025-01-22 before receding, indicating that exploitation interest developed well after initial disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49156
Vulnerability details
A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput…
more
request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.