55 lines
1.9 KiB
Diff
55 lines
1.9 KiB
Diff
|
From 56351307017e2501f7cd6e31efcfb55c19aba75a Mon Sep 17 00:00:00 2001
|
||
|
|
From: Matthieu Herrb <matthieu@herrb.eu>
|
||
|
|
Date: Thu, 10 Oct 2024 10:37:28 +0200
|
||
|
|
Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap()
|
||
|
|
MIME-Version: 1.0
|
||
|
|
Content-Type: text/plain; charset=UTF-8
|
||
|
|
Content-Transfer-Encoding: 8bit
|
||
|
|
|
||
|
|
The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
|
||
|
|
buffer.
|
||
|
|
|
||
|
|
However, It didn't update its size properly. It updated `num_si` only,
|
||
|
|
without updating `size_si`.
|
||
|
|
|
||
|
|
This may lead to local privilege escalation if the server is run as root
|
||
|
|
or remote code execution (e.g. x11 over ssh).
|
||
|
|
|
||
|
|
CVE-2024-9632, ZDI-CAN-24756
|
||
|
|
|
||
|
|
This vulnerability was discovered by:
|
||
|
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||
|
|
|
||
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||
|
|
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||
|
|
Reviewed-by: José Expósito <jexposit@redhat.com>
|
||
|
|
---
|
||
|
|
xkb/xkb.c | 8 ++++----
|
||
|
|
1 file changed, 4 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
||
|
|
index f203270d5..70e8279aa 100644
|
||
|
|
--- a/xkb/xkb.c
|
||
|
|
+++ b/xkb/xkb.c
|
||
|
|
@@ -2991,13 +2991,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
|
||
|
|
XkbSymInterpretPtr sym;
|
||
|
|
unsigned int skipped = 0;
|
||
|
|
|
||
|
|
- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
|
||
|
|
- compat->num_si = req->firstSI + req->nSI;
|
||
|
|
+ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
|
||
|
|
+ compat->num_si = compat->size_si = req->firstSI + req->nSI;
|
||
|
|
compat->sym_interpret = reallocarray(compat->sym_interpret,
|
||
|
|
- compat->num_si,
|
||
|
|
+ compat->size_si,
|
||
|
|
sizeof(XkbSymInterpretRec));
|
||
|
|
if (!compat->sym_interpret) {
|
||
|
|
- compat->num_si = 0;
|
||
|
|
+ compat->num_si = compat->size_si = 0;
|
||
|
|
return BadAlloc;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.46.2
|
||
|
|
|