Privilege Escalation Vulnerability in Xorg X Server by The X.Org Foundation
CVE-2018-14665

6.6MEDIUM

Key Information:

Vendor

X.org

Status
Xorg-server
Vendor
CVE Published:
25 October 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-14665?

A security flaw was discovered in Xorg X Server that allows unprivileged users to escalate their privileges. Specifically, improper permission checks for the '-modulepath' and '-logfile' options when starting the X server enable these users to execute arbitrary code with root privileges. This vulnerability can be exploited by anyone with physical access to the system, posing significant security risks.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2018-14665
Created by Rapid7

CVE-2018-14665
Created by jas502n

CVE-2018-14665
Created by bolonobolo

References

https://www.exploit-db.com/exploits/45742/
exploitx_refsource_EXPLOIT-DB
https://lists.x.org/archives/xorg-announce/2018-October/0...
mailing-listx_refsource_MLIST
https://www.exploit-db.com/exploits/45922/
exploitx_refsource_EXPLOIT-DB

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.