Skip to content
Fencer Intel
medium 5.9

CVE-2017-2624 json

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies.

published 2018-07-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11785

cvss
5.9
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.

Patch / fix

  • xorg-server Debian 14, Debian 13, Debian 12 2:1.19.2-1

debian advisories DEBIAN-CVE-2017-2624

  • xorg-server Ubuntu 14.04 LTS 2:1.15.1-0ubuntu2.9
  • xorg-server Ubuntu 16.04 LTS 2:1.18.4-0ubuntu0.3
  • xorg-server-hwe-16.04 Ubuntu 16.04 LTS 2:1.18.4-1ubuntu6.1~16.04.2
  • xorg-server-lts-xenial Ubuntu 14.04 LTS 2:1.18.3-1ubuntu2.3~trusty2

ubuntu advisories UBUNTU-CVE-2017-2624

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • xorg-x11-server SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2, SLES 12 SP2 +2 more 7.6_1.18.3-71.1

suse advisories SUSE-SU-2017:1675-1

  • xorg-x11-server openSUSE Tumbleweed 1.20.13-1.2

opensuse advisories openSUSE-SU-2024:11525-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-2624 updated cvss 5.9

xorg-x11-server: timing attack against MIT Cookie

  • Red Hat Enterprise Linux 5 xorg-x11-server Red Hat Enterprise Linux 6 xorg-x11-server, xorg-x11-server-Xdmx, xorg-x11-server-Xorg, xorg-x11-server-Xvfb, xorg-x11-server-Xnest, xorg-x11-server-common, +2 more Red Hat Enterprise Linux 7 xorg-x11-server, xorg-x11-server-Xdmx, xorg-x11-server-Xorg, xorg-x11-server-Xvfb, xorg-x11-server-Xnest, xorg-x11-server-common, +3 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 xorg-x11-server, xorg-x11-server-Xdmx, xorg-x11-server-Xorg, xorg-x11-server-Xvfb, xorg-x11-server-Xnest, xorg-x11-server-common, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.70% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • x41-dsec.de https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/ referenced PoC, tagged "exploit" by a source, unverified
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 5.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD 3.0 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N

Affected products

  • Xorg xorg-x11-server

Classification

Weakness
  • CWE-385 Covert Timing Channel
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.