CVE-2024-0229 is a high severity (CVSS 7.8) out-of-bounds memory access flaw in the X.Org server and Xwayland. It can crash the server, escalate privileges locally, or give remote code execution in SSH X11 forwarding setups. Apply the update from your distribution.
What's affected
The record names the X.Org X server and Xwayland, and lists Fedora 39 among affected distributions. The description says the issue can be triggered when a device frozen by a sync grab is reattached to a different master device. The possible results are an application crash, local privilege escalation if the server runs with extended privileges, or remote code execution in SSH X11 forwarding environments.
The record points to six Red Hat errata (RHSA-2024:0320, 0557, 0558, 0597, 0607 and 0614). We fetched RHSA-2024:0320, a Red Hat Enterprise Linux 7 update to xorg-x11-server version 1.20.4-27.el7_9, and its listing of fixed CVEs did not clearly name CVE-2024-0229 in our summary of it, so we cannot confirm which erratum covers which release. We also found no CVSS score for this CVE on that page, while the record gives 7.8. Check the erratum for your own release, and the upstream X.Org announcement for fixed upstream versions, which we could not confirm.
How to check if you're exposed
Check which X server your systems run and whether they have the distribution fix:
Xorg -version
rpm -q xorg-x11-server-Xorg xorg-x11-server-Xwayland
dpkg -l xserver-xorg-core xwayland
Use whichever matches your package manager, then compare against the fixed package in your distribution's advisory. For Red Hat family systems, rpm -q --changelog xorg-x11-server-Xorg | grep CVE-2024-0229 can show whether the package changelog mentions the fix.
Desktops and workstations are the obvious candidates, but also check servers where administrators use SSH X11 forwarding, and any system where Xvfb or Xwayland runs in a container for testing or remote desktop. The remote code execution case in the record is specific to X11 forwarding over SSH, so jump hosts with forwarding enabled deserve a look.
What to do now
- Find hosts that run Xorg, Xwayland or Xvfb, including containers.
- Apply your distribution's X server update and restart the X session or reboot as the advisory directs.
- On hosts that cannot be updated yet, turn off SSH X11 forwarding where it is not needed (the X11Forwarding option in sshd_config).
- Do not run the X server with extended privileges when you can avoid it.
- Confirm the installed package version afterwards.
Why it matters
The weakness class is CWE-787, an out-of-bounds write. In this case the trigger is a device state change, a frozen device being reattached to a different master device, which leads to memory access outside the intended bounds. The description names three outcomes in order of seriousness: a crash, privilege escalation if the server has extended privileges, and remote code execution through SSH X11 forwarding.
The X server is old, large and privileged software, and it sits between users and the display. Bugs in input device handling matter because an authenticated local client can send the requests that reach the code. The CVSS vector is local and low privilege with no user interaction, which matches the local escalation story. The remote case relies on X11 forwarding, which is why disabling it on hosts that do not need it is a sensible stopgap.
The record's KEV flag is false and we found no statement of exploitation.
Quick check
Which Red Hat advisory fixes CVE-2024-0229?
The record lists six, and we could not confirm which one matches your release. Check the erratum for your product version.
Does this affect Wayland desktops?
The record names Xwayland, the X compatibility layer, so systems that run it should apply the update too.
Sources
Last reviewed: 19 October 2026.
