CVE-2017-2624

Severity: high (CVSS 7.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-07-27 · updated 2026-06-17
Weakness: CWE-385

Description

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.

Affected products

Debian Linux: 7.0
xorg-x11-server: through 1.19.4

References

http://www.securityfocus.com/bid/96480
http://www.securitytracker.com/id/1037919
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624
https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c
https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html
https://security.gentoo.org/glsa/201704-03
https://security.gentoo.org/glsa/201710-30
https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/
http://www.securityfocus.com/bid/96480
http://www.securitytracker.com/id/1037919
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624
https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c

Get alerted when CVE-2017-2624 or the next vulnerability affects your stack