CVE-2018-14665
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows...
- Published
- Oct 25, 2018
- Updated
- Aug 5, 2024
- Assigning CNA
- redhat
- Evidence observed
- Oct 25, 2018
Primary CVSS
nvd · CVSS 2.0
AV:L/AC:L/Au:N/C:C/I:C/A:CModerate · next 30 days
- Percentile
- 98.0%
- Model date
- Oct 13, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.
Sources
modules/exploits/aix/local/xorg_x11_server.rb
Metasploit Framework modulesDeclared conditions
- platform: Unix($.exploit_aix/local/xorg_x11_server.platform)
- verification: check_declared($.exploit_aix/local/xorg_x11_server.check)
modules/exploits/multi/local/xorg_x11_suid_server.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_multi/local/xorg_x11_suid_server.platform)
- verification: check_declared($.exploit_multi/local/xorg_x11_suid_server.check)
modules/exploits/multi/local/xorg_x11_suid_server_modulepath.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Solaris,Unix($.exploit_multi/local/xorg_x11_suid_server_modulepath.platform)
- verification: check_declared($.exploit_multi/local/xorg_x11_suid_server_modulepath.check)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.