CVE-2021-3472

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-3472
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3472.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-3472
Downstream
ALPINE (1)
AZL (1)
BELL (1)
CLEANSTART (1)
DEBIAN (1)
MGASA (1)
OESA (1)
openSUSE (3)
RHSA (1)
SUSE (7)
UBUNTU (1)
Related
openSUSE (3)
SUSE (7)
Published
2021-04-26T15:15:07Z
Modified
2026-10-20T13:30:48Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "9.0"
                        },
                        {
                            "last_affected": "9.0"
                        },
                        {
                            "introduced": "10.0"
                        },
                        {
                            "last_affected": "10.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "debian:debian_linux"
        },
        {
            "cpes": [
                "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
                "cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "32"
                        },
                        {
                            "last_affected": "32"
                        },
                        {
                            "introduced": "33"
                        },
                        {
                            "last_affected": "33"
                        },
                        {
                            "introduced": "34"
                        },
                        {
                            "last_affected": "34"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "fedoraproject:fedora"
        },
        {
            "cpes": [
                "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "8.0"
                        },
                        {
                            "last_affected": "8.0"
                        }
                    ],
                    "source": "CPE_STRING"
                }
            ],
            "vendor_product": "redhat:enterprise_linux"
        }
    ]
}
References

Affected packages

Git / gitlab.freedesktop.org/xorg/xserver

Affected ranges

Type
GIT
Repo
https://gitlab.freedesktop.org/xorg/xserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6b767cdf6574081164aa6c6a7b617cda579b84c6
Introduced
0d7ec5c7d9b451066a079fe56bcc9722341a91ff
Last Affected
0d7ec5c7d9b451066a079fe56bcc9722341a91ff
Fixed
7aaf54a1884f71dc363f0b884e57bcb67407a6cd
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.20.11"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "cpe": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "range": [
                {
                    "fixed": "7aaf54a1884f71dc363f0b884e57bcb67407a6cd"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

7.*
7.0
Other
XORG-7_0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3472.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "292591907350474845185383934296722325623",
                "303364087205550092765687958017342392166",
                "19102639589196602912811957206626347227",
                "255171885618665939205673060985879529004"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2021-3472-405cf82e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://gitlab.freedesktop.org/xorg/xserver@7aaf54a1884f71dc363f0b884e57bcb67407a6cd",
        "target": {
            "file": "Xi/chgfctl.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "226544378372652833531133305372092978257",
            "length": 2476
        },
        "id": "CVE-2021-3472-afb01050",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://gitlab.freedesktop.org/xorg/xserver@7aaf54a1884f71dc363f0b884e57bcb67407a6cd",
        "target": {
            "file": "Xi/chgfctl.c",
            "function": "ProcXChangeFeedbackControl"
        }
    }
]
vanir_signatures_modified 
"2026-10-20T13:30:48Z"