CVE-2017-2624

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-2624
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-2624.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-2624
Downstream
DEBIAN (1)
MGASA (2)
openSUSE (1)
SUSE (1)
UBUNTU (1)
Related
Published
2018-07-27T18:29:00Z
Modified
2026-10-20T13:21:51Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.

References

Affected packages

Git / gitlab.freedesktop.org/xorg/xserver

Affected ranges

Type
GIT
Repo
https://gitlab.freedesktop.org/xorg/xserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
ec37e559614cf4eaba67d3ca0693f09fd95a5d57
Introduced
0d7ec5c7d9b451066a079fe56bcc9722341a91ff
Last Affected
0d7ec5c7d9b451066a079fe56bcc9722341a91ff
Fixed
d7ac755f0b618eb1259d93c8a16ec6e39a18627c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.19.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0"
                },
                {
                    "last_affected":  "7.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "d7ac755f0b618eb1259d93c8a16ec6e39a18627c"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

7.*
7.0
Other
XORG-7_0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-2624.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "44675475628667427906411722638807632347",
                "83435234544122330596383337453727725290",
                "246495687630101241807656372490502924673",
                "242654172581604024205415859549940946512"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2017-2624-03d4e614",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.freedesktop.org/xorg/xserver@d7ac755f0b618eb1259d93c8a16ec6e39a18627c",
        "target":  {
            "file":  "os/mitauth.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "154472361466984619362077251267719493621",
                "226145445792571596998190020540737906102",
                "265725287014319971204949272950739294120"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2017-2624-d009d9cc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.freedesktop.org/xorg/xserver@d7ac755f0b618eb1259d93c8a16ec6e39a18627c",
        "target":  {
            "file":  "include/os.h"
        }
    }
]
vanir_signatures_modified 
"2026-10-20T13:21:51Z"