CVE-2020-14347: Medium severity ibm cloud pak for security vulnerability
A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.
Other sources
Allocation for pixmap data in AllocatePixmap() does not initialize the memory in xserver, it leads to leak uninitialize heap memory to clients. When the X server runs with elevated privileges, this can lead to privilege elevation in the client.
— Red Hat
X.Org Xserver could allow a local authenticated attacker to obtain sensitive information, caused by the failure to initialize the memory in xserverr pixmap data by the allocation for pixmap data in AllocatePixmap() function. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information from heap memory, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-14347?
CVE-2020-14347 is a vulnerability in X.Org Xserver that allows a local authenticated attacker to obtain sensitive information.
How does CVE-2020-14347 work?
CVE-2020-14347 works by exploiting a failure to initialize the memory in xserver pixmap data, which can leak parts of sensitive information.
What is the severity of CVE-2020-14347?
CVE-2020-14347 has a severity rating of high.
Which software versions are affected by CVE-2020-14347?
The affected software versions of CVE-2020-14347 are xorg-server-hwe-18.04 (2:1.20.8-2ubuntu2.2~18.04.2), xorg-server-hwe-18.04 (1.20.9), xorg-server (2:1.19.6-1ubuntu4.5), xorg-server (2:1.20.8-2ubuntu2.3), xorg-server (2:1.15.1-0ubuntu2.11+), xorg-server (2:1.18.4-0ubuntu0.9), xorg-server-hwe-16.04 (1.20.9), xorg-server-hwe-16.04 (2:1.19.6-1ubuntu4.1~16.04.3), xorg-server (1.20.9), xorg-server (2:1.20.9-1), and xorg-server (2:1.20.4-1+deb10u1).
How do I fix CVE-2020-14347?
To fix CVE-2020-14347, update to the latest version of the affected software packages: xorg-server-hwe-18.04 (2:1.20.8-2ubuntu2.2~18.04.2), xorg-server-hwe-18.04 (1.20.9), xorg-server (2:1.19.6-1ubuntu4.5), xorg-server (2:1.20.8-2ubuntu2.3), xorg-server (2:1.15.1-0ubuntu2.11+), xorg-server (2:1.18.4-0ubuntu0.9), xorg-server-hwe-16.04 (1.20.9), xorg-server-hwe-16.04 (2:1.19.6-1ubuntu4.1~16.04.3), xorg-server (1.20.9), xorg-server (2:1.20.9-1), and xorg-server (2:1.20.4-1+deb10u1).