CVE-2021-3472

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3472
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3472.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3472
Downstream
ALPINE (1)
AZL (1)
BELL (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (3)
RHSA (1)
SUSE (7)
UBUNTU (1)
Related
openSUSE (3)
SUSE (7)
Published
2021-04-26T15:15:07Z
Modified
2026-08-07T17:02:16Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Database specific 
{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        },
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "32"
                },
                {
                    "last_affected":  "32"
                },
                {
                    "introduced":  "33"
                },
                {
                    "last_affected":  "33"
                },
                {
                    "introduced":  "34"
                },
                {
                    "last_affected":  "34"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "fedoraproject:fedora"
        },
        {
            "cpes":  [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "8.0"
                },
                {
                    "last_affected":  "8.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "redhat:enterprise_linux"
        }
    ]
}
References

Affected packages

Git / gitlab.freedesktop.org/xorg/xserver

Affected ranges

Type
GIT
Repo
https://gitlab.freedesktop.org/xorg/xserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b767cdf6574081164aa6c6a7b617cda579b84c6
Introduced
0d7ec5c7d9b451066a079fe56bcc9722341a91ff
Last Affected
0d7ec5c7d9b451066a079fe56bcc9722341a91ff
Fixed
7aaf54a1884f71dc363f0b884e57bcb67407a6cd
Database specific
Show details 
{
    "cpe":  [
        "cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*",
        "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*"
    ],
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.20.11"
        },
        {
            "introduced":  "7.0"
        },
        {
            "last_affected":  "7.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

7.*
7.0
Other
XORG-7_0
XORG-7_0_99_901
pre-xgldrop-merge
xorg-server-1_0_99_1
xorg-server-1_0_99_2
xorg-server-1_0_99_901
xorg-server-1_1_99_1
xorg-server-1_1_99_2
xorg-server-1.*
xorg-server-1.1.99.3
xorg-server-1.10.0
xorg-server-1.10.99.901
xorg-server-1.10.99.902
xorg-server-1.11.0
xorg-server-1.11.99.1
xorg-server-1.11.99.901
xorg-server-1.11.99.902
xorg-server-1.11.99.903
xorg-server-1.12.0
xorg-server-1.12.99.901
xorg-server-1.12.99.902
xorg-server-1.12.99.903
xorg-server-1.12.99.904
xorg-server-1.12.99.905
xorg-server-1.13.0
xorg-server-1.13.99.901
xorg-server-1.13.99.902
xorg-server-1.14.0
xorg-server-1.14.99.1
xorg-server-1.14.99.2
xorg-server-1.14.99.3
xorg-server-1.14.99.901
xorg-server-1.14.99.902
xorg-server-1.14.99.903
xorg-server-1.14.99.904
xorg-server-1.14.99.905
xorg-server-1.15.0
xorg-server-1.15.99.901
xorg-server-1.15.99.902
xorg-server-1.15.99.903
xorg-server-1.15.99.904
xorg-server-1.16.0
xorg-server-1.16.99.901
xorg-server-1.16.99.902
xorg-server-1.17.0
xorg-server-1.17.99.901
xorg-server-1.17.99.902
xorg-server-1.18.0
xorg-server-1.18.99.2
xorg-server-1.18.99.901
xorg-server-1.18.99.902
xorg-server-1.19.0
xorg-server-1.19.99.901
xorg-server-1.19.99.902
xorg-server-1.19.99.903
xorg-server-1.19.99.904
xorg-server-1.19.99.905
xorg-server-1.20.0
xorg-server-1.20.1
xorg-server-1.20.10
xorg-server-1.20.2
xorg-server-1.20.3
xorg-server-1.20.4
xorg-server-1.20.5
xorg-server-1.20.6
xorg-server-1.20.7
xorg-server-1.20.8
xorg-server-1.20.9
xorg-server-1.5.99.1
xorg-server-1.6.99.900
xorg-server-1.6.99.901
xorg-server-1.7.99.1
xorg-server-1.7.99.2
xorg-server-1.7.99.901
xorg-server-1.7.99.902
xorg-server-1.8.0
xorg-server-1.8.99.901
xorg-server-1.8.99.902
xorg-server-1.8.99.903
xorg-server-1.8.99.904
xorg-server-1.8.99.905
xorg-server-1.8.99.906
xorg-server-1.9.0
xorg-server-1.9.99.901
xorg-server-1.9.99.902
xorg-server-1.9.99.903

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3472.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "292591907350474845185383934296722325623",
                "303364087205550092765687958017342392166",
                "19102639589196602912811957206626347227",
                "255171885618665939205673060985879529004"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2021-3472-405cf82e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://gitlab.freedesktop.org/xorg/xserver@7aaf54a1884f71dc363f0b884e57bcb67407a6cd",
        "target":  {
            "file":  "Xi/chgfctl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "226544378372652833531133305372092978257",
            "length":  2476
        },
        "id":  "CVE-2021-3472-afb01050",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://gitlab.freedesktop.org/xorg/xserver@7aaf54a1884f71dc363f0b884e57bcb67407a6cd",
        "target":  {
            "file":  "Xi/chgfctl.c",
            "function":  "ProcXChangeFeedbackControl"
        }
    }
]
vanir_signatures_modified 
"2026-08-07T17:02:16Z"