{"id":"CVE-2017-2624","details":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","modified":"2026-08-07T14:49:03.228082Z","published":"2018-07-27T18:29:00.827Z","related":["SUSE-SU-2017:1675-1","openSUSE-SU-2024:11525-1"],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/96480"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1037919"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201704-03"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201710-30"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624"},{"type":"FIX","url":"https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c"},{"type":"EVIDENCE","url":"https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/xorg/xserver","events":[{"introduced":"0"},{"last_affected":"ec37e559614cf4eaba67d3ca0693f09fd95a5d57"},{"introduced":"0d7ec5c7d9b451066a079fe56bcc9722341a91ff"},{"last_affected":"0d7ec5c7d9b451066a079fe56bcc9722341a91ff"},{"fixed":"d7ac755f0b618eb1259d93c8a16ec6e39a18627c"}],"database_specific":{"cpe":["cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.19.4"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":["CPE_RANGE","CPE_STRING","REFERENCES"]}}],"versions":["7.0","xorg-server-1.19.4","xorg-server-1.19.3","xorg-server-1.19.2","xorg-server-1.19.1","xorg-server-1.19.0","xorg-server-1.18.99.902","xorg-server-1.18.99.901","xorg-server-1.18.99.2","xorg-server-1.18.0","xorg-server-1.17.99.902","xorg-server-1.17.99.901","xorg-server-1.17.0","xorg-server-1.16.99.902","xorg-server-1.16.99.901","xorg-server-1.16.0","xorg-server-1.15.99.904","xorg-server-1.15.99.903","xorg-server-1.15.99.902","xorg-server-1.15.99.901","xorg-server-1.15.0","xorg-server-1.14.99.905","xorg-server-1.14.99.904","xorg-server-1.14.99.903","xorg-server-1.14.99.902","xorg-server-1.14.99.901","xorg-server-1.14.99.3","xorg-server-1.14.99.2","xorg-server-1.14.99.1","xorg-server-1.14.0","xorg-server-1.13.99.902","xorg-server-1.13.99.901","xorg-server-1.13.0","xorg-server-1.12.99.905","xorg-server-1.12.99.904","xorg-server-1.12.99.903","xorg-server-1.12.99.902","xorg-server-1.12.99.901","xorg-server-1.12.0","xorg-server-1.11.99.903","xorg-server-1.11.99.902","xorg-server-1.11.99.901","xorg-server-1.11.99.1","xorg-server-1.11.0","xorg-server-1.10.99.902","xorg-server-1.10.99.901","xorg-server-1.10.0","xorg-server-1.9.99.903","xorg-server-1.9.99.902","xorg-server-1.9.99.901","xorg-server-1.9.0","xorg-server-1.8.99.906","xorg-server-1.8.99.905","xorg-server-1.8.99.904","xorg-server-1.8.99.903","xorg-server-1.8.99.902","xorg-server-1.8.99.901","xorg-server-1.8.0","xorg-server-1.7.99.902","xorg-server-1.7.99.901","xorg-server-1.7.99.2","xorg-server-1.7.99.1","xorg-server-1.6.99.901","xorg-server-1.6.99.900","xorg-server-1.5.99.1","xorg-server-1.1.99.3","xorg-server-1_1_99_2","xorg-server-1_0_99_901","XORG-7_0_99_901","xorg-server-1_1_99_1","xorg-server-1_0_99_2","xorg-server-1_0_99_1","XORG-7_0","pre-xgldrop-merge"],"database_specific":{"vanir_signatures_modified":"2026-08-07T14:49:03Z","vanir_signatures":[{"id":"CVE-2017-2624-03d4e614","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/xorg/xserver@d7ac755f0b618eb1259d93c8a16ec6e39a18627c","target":{"file":"os/mitauth.c"},"deprecated":false,"digest":{"line_hashes":["44675475628667427906411722638807632347","83435234544122330596383337453727725290","246495687630101241807656372490502924673","242654172581604024205415859549940946512"],"threshold":0.9}},{"id":"CVE-2017-2624-d009d9cc","signature_type":"Line","signature_version":"v1","source":"https://gitlab.freedesktop.org/xorg/xserver@d7ac755f0b618eb1259d93c8a16ec6e39a18627c","target":{"file":"include/os.h"},"deprecated":false,"digest":{"line_hashes":["154472361466984619362077251267719493621","226145445792571596998190020540737906102","265725287014319971204949272950739294120"],"threshold":0.9}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-2624.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}