medium 5.5

CVE-2022-3550 json

X.org Server xkb.c _GetCountedString buffer overflow

published 2022-10-17 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-42916

cvss: 5.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.0%; EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits: 0; none known

A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.

Patch / fix

fixed in 1 distros 6 links 1

x.org x_server 21.1.6

debian ubuntu red hat suse opensuse almalinux

xwayland Debian 14, Debian 13, Debian 12 2:22.1.5-1
xorg-server Debian 14, Debian 13, Debian 12 2:21.1.4-3

debian advisories DEBIAN-CVE-2022-3550

xwayland Ubuntu 22.04 LTS 2:22.1.1-1ubuntu0.3
xorg-server Ubuntu 18.04 LTS 2:1.19.6-1ubuntu4.12
xorg-server Ubuntu 20.04 LTS 2:1.20.13-1ubuntu1~20.04.4
xorg-server Ubuntu 22.04 LTS 2:21.1.3-2ubuntu2.3
xorg-server-hwe-18.04 Ubuntu 18.04 LTS 2:1.20.8-2ubuntu2.2~18.04.8
xorg-server Ubuntu Pro 14.04 LTS 2:1.15.1-0ubuntu2.11+esm6
xorg-server Ubuntu Pro 16.04 LTS 2:1.18.4-0ubuntu0.12+esm4
xorg-server-hwe-16.04 Ubuntu Pro 16.04 LTS 2:1.19.6-1ubuntu4.1~16.04.6+esm3

ubuntu advisories UBUNTU-CVE-2022-3550

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

xorg-x11-server RHEL 8 1.20.11-15.el8
xorg-x11-server-Xdmx RHEL 8 1.20.11-15.el8
xorg-x11-server-Xorg RHEL 8 1.20.11-15.el8
xorg-x11-server-Xvfb RHEL 8 1.20.11-15.el8
xorg-x11-server-Xnest RHEL 8 1.20.11-15.el8
xorg-x11-server-common RHEL 8 1.20.11-15.el8
xorg-x11-server-source RHEL 8 1.20.11-15.el8
xorg-x11-server-Xephyr RHEL 8 1.20.11-15.el8

red hat advisories RHSA-2023:2806 RHSA-2023:2805 RHSA-2023:2248 RHSA-2023:2249 RHSA-2022:8491

xwayland SLE Workstation Extension 15 SP4, openSUSE Leap 15.4 21.1.4-150400.3.3.1
xorg-x11-server SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.19.6-10.35.1
xorg-x11-server SLE Module for Development Tools 15 SP4, SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 1.20.3-150400.38.8.1
xorg-x11-server SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +12 more 1.20.3-150200.22.5.58.1
xorg-x11-server SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 1.20.3-150100.14.5.28.1
xorg-x11-server SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 1.19.6-150000.8.42.1
xorg-x11-server SLES for SAP 12 SP4, SLES 12 SP4-LTSS, OpenStack Cloud Crowbar 9 +1 more 1.19.6-4.34.1
xorg-x11-server SLES 12 SP3-BCL, SLES 12 SP2-BCL 7.6_1.18.3-76.52.1

suse advisories SUSE-SU-2022:3941-1 SUSE-SU-2022:3863-1 SUSE-SU-2022:3862-1 SUSE-SU-2022:3857-1 SUSE-SU-2022:3856-1 SUSE-SU-2022:3850-1

xorg-x11-server openSUSE Tumbleweed 21.1.4-2.1
xwayland openSUSE Tumbleweed 22.1.3-2.1

opensuse advisories openSUSE-SU-2024:12427-1 openSUSE-SU-2024:12428-1

xorg-x11-server-Xwayland AlmaLinux 8 21.1.3-10.el8
xorg-x11-server-Xdmx AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xorg AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xvfb AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xnest AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-common AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-source AlmaLinux 8 1.20.11-15.el8
xorg-x11-server-Xephyr AlmaLinux 8 1.20.11-15.el8

almalinux advisories ALSA-2023:2805 ALSA-2023:2806 ALSA-2023:2248 ALSA-2023:2249

cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bf… commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3550 updated 2026-11-04 cvss 8.8

xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c

Red Hat Enterprise Linux 6 xorg-x11-server, xorg-x11-server-Xdmx, xorg-x11-server-Xorg, xorg-x11-server-Xvfb, xorg-x11-server-Xnest, xorg-x11-server-common, +2 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server 1.20.11-15.el8, xorg-x11-server-Xdmx 1.20.11-15.el8, xorg-x11-server-Xorg 1.20.11-15.el8, xorg-x11-server-Xvfb 1.20.11-15.el8, xorg-x11-server-Xnest 1.20.11-15.el8, xorg-x11-server-common 1.20.11-15.el8, +2 more
fixed: vendor fix RHSA-2023:2806
Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server 1.20.11-17.el9, xorg-x11-server-Xdmx 1.20.11-17.el9, xorg-x11-server-Xorg 1.20.11-17.el9, xorg-x11-server-Xvfb 1.20.11-17.el9, xorg-x11-server-Xnest 1.20.11-17.el9, xorg-x11-server-common 1.20.11-17.el9, +2 more
fixed: vendor fix RHSA-2023:2248
Red Hat Enterprise Linux Client (v. 7) xorg-x11-server 1.20.4-19.el7_9, xorg-x11-server-Xorg 1.20.4-19.el7_9, xorg-x11-server-common 1.20.4-19.el7_9, xorg-x11-server-Xephyr 1.20.4-19.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) xorg-x11-server-Xdmx 1.20.4-19.el7_9, xorg-x11-server-Xvfb 1.20.4-19.el7_9, xorg-x11-server-Xnest 1.20.4-19.el7_9, xorg-x11-server-source 1.20.4-19.el7_9, xorg-x11-server-Xwayland 1.20.4-19.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) xorg-x11-server 1.20.4-19.el7_9, xorg-x11-server-Xdmx 1.20.4-19.el7_9, xorg-x11-server-Xorg 1.20.4-19.el7_9, xorg-x11-server-Xvfb 1.20.4-19.el7_9, xorg-x11-server-Xnest 1.20.4-19.el7_9, xorg-x11-server-common 1.20.4-19.el7_9, +3 more
fixed: vendor fix RHSA-2022:8491
Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-source 1.20.11-15.el8
fixed: vendor fix RHSA-2023:2806
Red Hat Enterprise Linux CRB (v. 9) xorg-x11-server-source 1.20.11-17.el9
fixed: vendor fix RHSA-2023:2248
Red Hat Enterprise Linux Server (v. 7) xorg-x11-server 1.20.4-19.el7_9, xorg-x11-server-Xorg 1.20.4-19.el7_9, xorg-x11-server-common 1.20.4-19.el7_9, xorg-x11-server-Xephyr 1.20.4-19.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) xorg-x11-server-Xdmx 1.20.4-19.el7_9, xorg-x11-server-Xvfb 1.20.4-19.el7_9, xorg-x11-server-Xnest 1.20.4-19.el7_9, xorg-x11-server-source 1.20.4-19.el7_9, xorg-x11-server-Xwayland 1.20.4-19.el7_9 Red Hat Enterprise Linux Workstation (v. 7) xorg-x11-server 1.20.4-19.el7_9, xorg-x11-server-Xorg 1.20.4-19.el7_9, xorg-x11-server-common 1.20.4-19.el7_9, xorg-x11-server-Xephyr 1.20.4-19.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) xorg-x11-server-Xdmx 1.20.4-19.el7_9, xorg-x11-server-Xvfb 1.20.4-19.el7_9, xorg-x11-server-Xnest 1.20.4-19.el7_9, xorg-x11-server-source 1.20.4-19.el7_9, xorg-x11-server-Xwayland 1.20.4-19.el7_9
fixed: vendor fix RHSA-2022:8491

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-14)

Exploit prediction

2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.5	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
NVD	3.1	8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

X.org Server

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120 Buffer Copy without Checking Size of Input

References

cgit.freedesktop.org /xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e
mailing-list, patch, vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/OXZZ6JBDBVBYPDI6DUTY6N36GNW37YHK/
vendor-advisory
debian.org /security/2022/dsa-5278
vendor-advisory, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/X7W3NXSYK4P3XCZQBI3U6UWP4DPZIMRZ/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/IOEDFBYPSE3EMVHTEFCVEJD2R2Y5F2A5/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/3QTPFVGYTOY4EWTJEBH3YGDTTU57FZAK/
vendor-advisory
security.gentoo.org /glsa/202305-30
vendor-advisory
vuldb.com /?id.211051
third-party-advisory, vdb-entry
lists.debian.org /debian-lts-announce/2022/11/msg00012.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2022-3550
NVD CVE-2022-3550

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary