rpms/tigervnc
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import tigervnc-1.12.0-9.el8_7.2

Browse Source
This commit is contained in:
CentOS Sources 2023-04-04 08:52:29 +00:00 committed by Stepan Oksanichenko
parent 5ca55f1f32
commit 145af0d40d
2 changed files with 1 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch
View File

@ -1,42 +0,0 @@
From 947bd1b3f4a23565bf10879ec41ba06ebe1e1c76 Mon Sep 17 00:00:00 2001
From: Olivier Fourdan <ofourdan@redhat.com>
Date: Mon, 13 Mar 2023 11:08:47 +0100
Subject: [PATCH xserver] composite: Fix use-after-free of the COW
ZDI-CAN-19866/CVE-2023-1393
If a client explicitly destroys the compositor overlay window (aka COW),
we would leave a dangling pointer to that window in the CompScreen
structure, which will trigger a use-after-free later.
Make sure to clear the CompScreen pointer to the COW when the latter gets
destroyed explicitly by the client.
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Adam Jackson <ajax@redhat.com>
---
composite/compwindow.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/composite/compwindow.c b/composite/compwindow.c
index 4e2494b86..b30da589e 100644
--- a/composite/compwindow.c
+++ b/composite/compwindow.c
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
ret = (*pScreen->DestroyWindow) (pWin);
cs->DestroyWindow = pScreen->DestroyWindow;
pScreen->DestroyWindow = compDestroyWindow;
+
+ /* Did we just destroy the overlay window? */
+ if (pWin == cs->pOverlayWin)
+ cs->pOverlayWin = NULL;
+
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
return ret;
}
--
2.40.0

9
SPECS/tigervnc.spec
View File

@ -5,7 +5,7 @@
Name: tigervnc
Version: 1.12.0
Release: 9%{?dist}.3
Release: 9%{?dist}.2
Summary: A TigerVNC remote display system
%global _hardened_build 1
@ -41,8 +41,6 @@ Patch101: 0001-rpath-hack.patch
# CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
Patch110: xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
# CVE-2023-1393 tigervnc: xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
Patch111: xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch
BuildRequires: gcc-c++
BuildRequires: libX11-devel, automake, autoconf, libtool, gettext, gettext-autopoint
@ -166,7 +164,6 @@ done
%patch100 -p1 -b .xserver120-rebased
%patch101 -p1 -b .rpath
%patch110 -p1 -b .Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
%patch111 -p1 -b .composite-Fix-use-after-free-of-the-COW
popd
%patch1 -p1 -b .use-gnome-as-default-session
@ -333,10 +330,6 @@ fi
%ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
%changelog
*Mon Mar 27 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.3
- xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
Resolves: bz#2180304
* Wed Feb 15 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.2
- Add sanity check when cleaning up keymap changes
Resolves: bz#2169962