Bug 1206017 (CVE-2022-4283) - VUL-0: CVE-2022-4283,CVE-2022-46283: xorg-x11-server, xwayland: XkbGetKbdByName use-after-free (ZDI-CAN-19530)
Summary: VUL-0: CVE-2022-4283,CVE-2022-46283: xorg-x11-server, xwayland: XkbGetKbdByNa...
Status: RESOLVED FIXED
Alias: CVE-2022-4283
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/349740/
Whiteboard: CVSSv3.1:SUSE:CVE-2022-4283:7.8:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-05 07:55 UTC by Thomas Leroy
Modified: 2024-03-28 05:31 UTC (History)
5 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
patch (1020 bytes, patch)
2022-12-05 07:55 UTC, Thomas Leroy 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2022-12-05 07:55:32 UTC 
Created attachment 863293 [details]
patch

ZDI-CAN-19530

Use-after-free in xkbUtils:
Unlike other elements of the keymap, this pointer was freed but not
reset. On a subsequent XkbGetKbdByName request, the server may access
already freed memory.

CVE ongoing.
Comment 6 Stefan Dirsch 2022-12-14 11:03:32 UTC 
(temporary resume from vacation just not to block this security update until January)

Now also submitted for

- openSUSE:Factory/xorg-x11-server
- openSUSE:Factory/xwayland

Reassigning to security team.
Comment 7 Alexander Bergmann 2022-12-14 11:33:03 UTC 
Public now:

https://lists.x.org/archives/xorg-announce/2022-December/003302.html
Comment 8 OBSbugzilla Bot 2022-12-14 11:35:14 UTC 
This is an autogenerated message for OBS integration:
This bug (1206017) was mentioned in
https://build.opensuse.org/request/show/1042895 Factory / xorg-x11-server
https://build.opensuse.org/request/show/1042896 Factory / xwayland
Comment 9 Swamp Workflow Management 2022-12-14 17:24:03 UTC 
SUSE-SU-2022:4485-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
SUSE Linux Enterprise Server 12-SP3-BCL (src):    xorg-x11-server-7.6_1.18.3-76.57.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    xorg-x11-server-7.6_1.18.3-76.57.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Swamp Workflow Management 2022-12-14 17:25:16 UTC 
SUSE-SU-2022:4483-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    xorg-x11-server-1.19.6-10.40.1
SUSE Linux Enterprise Server 12-SP5 (src):    xorg-x11-server-1.19.6-10.40.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2022-12-14 17:27:27 UTC 
SUSE-SU-2022:4484-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    xorg-x11-server-1.19.6-4.39.1
SUSE OpenStack Cloud 9 (src):    xorg-x11-server-1.19.6-4.39.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    xorg-x11-server-1.19.6-4.39.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    xorg-x11-server-1.19.6-4.39.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2022-12-14 17:28:37 UTC 
SUSE-SU-2022:4487-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    xwayland-21.1.4-150400.3.6.1
SUSE Linux Enterprise Workstation Extension 15-SP4 (src):    xwayland-21.1.4-150400.3.6.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2022-12-14 17:30:37 UTC 
SUSE-SU-2022:4480-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
openSUSE Leap 15.3 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Manager Server 4.1 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Manager Retail Branch Server 4.1 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Manager Proxy 4.1 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise Workstation Extension 15-SP4 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise Workstation Extension 15-SP3 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise Module for Development Tools 15-SP3 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    xorg-x11-server-1.20.3-150200.22.5.63.1
SUSE Enterprise Storage 7 (src):    xorg-x11-server-1.20.3-150200.22.5.63.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 14 Swamp Workflow Management 2022-12-14 17:32:35 UTC 
SUSE-SU-2022:4479-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    xorg-x11-server-1.20.3-150400.38.13.1
SUSE Linux Enterprise Module for Development Tools 15-SP4 (src):    xorg-x11-server-1.20.3-150400.38.13.1
SUSE Linux Enterprise Module for Basesystem 15-SP4 (src):    xorg-x11-server-1.20.3-150400.38.13.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Swamp Workflow Management 2022-12-14 17:35:22 UTC 
SUSE-SU-2022:4482-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    xorg-x11-server-1.19.6-150000.8.47.1
SUSE Linux Enterprise Server 15-LTSS (src):    xorg-x11-server-1.19.6-150000.8.47.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    xorg-x11-server-1.19.6-150000.8.47.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    xorg-x11-server-1.19.6-150000.8.47.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 16 Swamp Workflow Management 2022-12-14 17:37:34 UTC 
SUSE-SU-2022:4481-1: An update that solves 6 vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 1205874,1205875,1205876,1205877,1205878,1205879,1206017
CVE References: CVE-2022-4283,CVE-2022-46340,CVE-2022-46341,CVE-2022-46342,CVE-2022-46343,CVE-2022-46344
JIRA References: 
Sources used:
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    xorg-x11-server-1.20.3-150100.14.5.33.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    xorg-x11-server-1.20.3-150100.14.5.33.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    xorg-x11-server-1.20.3-150100.14.5.33.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    xorg-x11-server-1.20.3-150100.14.5.33.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    xorg-x11-server-1.20.3-150100.14.5.33.1
SUSE Enterprise Storage 6 (src):    xorg-x11-server-1.20.3-150100.14.5.33.1
SUSE CaaS Platform 4.0 (src):    xorg-x11-server-1.20.3-150100.14.5.33.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 17 Carlos López 2022-12-29 08:55:24 UTC 
It seems this bug (ZDI-CAN-19530) got another CVE ID assigned, CVE-2022-46283:
https://www.zerodayinitiative.com/advisories/ZDI-22-1700/

In the xorg advisory [0] both IDs appear:

> * CVE-2022-46283/ZDI-CAN-19530: X.Org Server XkbGetKbdByName use-after-free

> CVE-2022-4283, ZDI-CAN-19530

[0] https://lists.x.org/archives/xorg-announce/2022-December/003302.html
Comment 18 Carlos López 2022-12-29 08:55:48 UTC 
All done, closing.