CVE-2024-0229

HighCVSS 7.8/10Last modified Nov 4, 2026

Description

An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
——>= 21.1.0, < 21.1.11
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 6—

References

Timeline

Published
Feb 9, 2024
Last modified
Nov 4, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-02302.4A session management issue was addressed with improved checks. This issue is fixed in Magic Keyboard Firmware Update 2.0.6. An attacker withCVE-2024-02312.7A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows aCVE-2024-02325.5A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attCVE-2024-02336.1The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outpCVE-2024-02355.3The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unautCVE-2024-02365.3The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unautCVE-2024-02375.3The EventON WordPress plugin through 4.5.8, EventON WordPress plugin before 2.2.7 do not have authorisation in some AJAX actions, allowing uCVE-2024-02386.1The EventON Premium WordPress plugin before 4.5.6, EventON WordPress plugin before 2.2.8 do not have authorisation in an AJAX action, and doCVE-2024-02396.1The Contact Form 7 Connector WordPress plugin before 1.2.3 does not sanitise and escape a parameter before outputting it back in the page, lCVE-2024-02406.5A memory leak in the Silicon Labs' Bluetooth stack for EFR32 products may cause memory to be exhausted when sending notifications to multiplCVE-2024-02417.5encoded_id-rails versions before 1.0.0.beta2 are affected by an uncontrolled resource consumption vulnerability. A remote and unauthenticateCVE-2024-02429.8Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings.