CVE-2024-9632

What it actually does

Improperly tracked allocation size in _XkbSetCompatMap allows a local attacker to trigger a buffer overflow via a crafted payload, resulting in denial of service or local privilege escalation when the X.org server runs with root privileges.

Why it matters to the business

Attackers with local access can crash the system or gain elevated privileges, potentially leading to full host compromise in environments where the affected component runs with elevated rights; low exploit probability but high impact on affected Ubuntu systems.

How an attack unfolds

A local attacker crafts a malicious payload targeting the compatibility map handling routine, sending it to trigger uncontrolled allocation that overflows the buffer and allows arbitrary code execution or service termination.

How to fix it

Upgrade putty on Ubuntu 16.04 LTS to version 0.66-1 or later; apply all vendor patches for the X.org server component and verify the server no longer runs with unnecessary root privileges.

How to confirm the fix worked

Confirm the installed package version meets or exceeds the fixed release, review process privileges for the X server, and test that crafted XKB payloads no longer cause overflows or crashes.

Typical attack path

1. Obtain local access to an affected system
2. Craft and deliver a malicious XKB compatibility map payload
3. Trigger the vulnerable allocation path in the server
4. Achieve buffer overflow leading to DoS or privilege escalation

How to detect it

Review system logs for X server crashes or unexpected terminations around the time of suspected local activity; inspect authentication and process execution logs for privilege escalation indicators.

What your security team should do

• Prioritize patching putty and related X.org components on all Ubuntu 16.04 systems within standard change windows
• Audit whether the X server runs as root and reduce privileges where possible
• Monitor local access logs and process behavior for unexpected crashes or privilege changes