diff --git a/SOURCES/tigervnc-selinux-allow-vncsession-create-vnc-directory.patch b/SOURCES/tigervnc-selinux-allow-vncsession-create-vnc-directory.patch new file mode 100644 index 0000000..d6bc61b --- /dev/null +++ b/SOURCES/tigervnc-selinux-allow-vncsession-create-vnc-directory.patch @@ -0,0 +1,31 @@ +From 717d787de8f913070446444e37d552b51f05515e Mon Sep 17 00:00:00 2001 +From: Zdenek Pytela +Date: Mon, 16 Jan 2023 12:35:40 +0100 +Subject: [PATCH] SELinux: Allow vncsession create ~/.vnc directory + +Addresses the following AVC denial: + +type=PROCTITLE msg=audit(01/12/2023 02:58:12.648:696) : proctitle=/usr/sbin/vncsession fedora :1 +type=PATH msg=audit(01/12/2023 02:58:12.648:696) : item=1 name=/home/fedora/.vnc nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 +type=PATH msg=audit(01/12/2023 02:58:12.648:696) : item=0 name=/home/fedora/ inode=262145 dev=fc:02 mode=dir,700 ouid=fedora ogid=fedora rdev=00:00 obj=unconfined_u:object_r:user_home_dir_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 +type=CWD msg=audit(01/12/2023 02:58:12.648:696) : cwd=/home/fedora +type=SYSCALL msg=audit(01/12/2023 02:58:12.648:696) : arch=x86_64 syscall=mkdir success=no exit=EACCES(Permission denied) a0=0x7fff47d52540 a1=0755 a2=0x0 a3=0x0 items=2 ppid=2869 pid=2880 auid=fedora uid=fedora gid=fedora euid=fedora suid=fedora fsuid=fedora egid=fedora sgid=fedora fsgid=fedora tty=(none) ses=8 comm=vncsession exe=/usr/sbin/vncsession subj=system_u:system_r:vnc_session_t:s0 key=(null) +type=AVC msg=audit(01/12/2023 02:58:12.648:696) : avc: denied { create } for pid=2880 comm=vncsession name=.vnc scontext=system_u:system_r:vnc_session_t:s0 tcontext=system_u:object_r:vnc_home_t:s0 tclass=dir permissive=0 + +Resolves: rhbz#2143704 +--- + unix/vncserver/selinux/vncsession.te | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/unix/vncserver/selinux/vncsession.te b/unix/vncserver/selinux/vncsession.te +index fb966c14b..680be8ea1 100644 +--- a/unix/vncserver/selinux/vncsession.te ++++ b/unix/vncserver/selinux/vncsession.te +@@ -37,6 +37,7 @@ allow vnc_session_t self:fifo_file rw_fifo_file_perms; + allow vnc_session_t vnc_session_var_run_t:file manage_file_perms; + files_pid_filetrans(vnc_session_t, vnc_session_var_run_t, file) + ++create_dirs_pattern(vnc_session_t, vnc_home_t, vnc_home_t) + manage_files_pattern(vnc_session_t, vnc_home_t, vnc_home_t) + manage_fifo_files_pattern(vnc_session_t, vnc_home_t, vnc_home_t) + manage_sock_files_pattern(vnc_session_t, vnc_home_t, vnc_home_t) diff --git a/SOURCES/xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch b/SOURCES/xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch deleted file mode 100644 index 2389895..0000000 --- a/SOURCES/xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 7150ba655c0cc08fa6ded309b81265bb672f2869 Mon Sep 17 00:00:00 2001 -From: Peter Hutterer -Date: Wed, 25 Jan 2023 11:41:40 +1000 -Subject: [PATCH xserver] Xi: fix potential use-after-free in - DeepCopyPointerClasses - -CVE-2023-0494, ZDI-CAN 19596 - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Peter Hutterer ---- - Xi/exevents.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/Xi/exevents.c b/Xi/exevents.c -index 217baa9561..dcd4efb3bc 100644 ---- a/Xi/exevents.c -+++ b/Xi/exevents.c -@@ -619,8 +619,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) - memcpy(to->button->xkb_acts, from->button->xkb_acts, - sizeof(XkbAction)); - } -- else -+ else { - free(to->button->xkb_acts); -+ to->button->xkb_acts = NULL; -+ } - - memcpy(to->button->labels, from->button->labels, - from->button->numButtons * sizeof(Atom)); --- -2.39.0 - diff --git a/SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch b/SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch new file mode 100644 index 0000000..ee1ae7b --- /dev/null +++ b/SOURCES/xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch @@ -0,0 +1,42 @@ +From 947bd1b3f4a23565bf10879ec41ba06ebe1e1c76 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 13 Mar 2023 11:08:47 +0100 +Subject: [PATCH xserver] composite: Fix use-after-free of the COW + +ZDI-CAN-19866/CVE-2023-1393 + +If a client explicitly destroys the compositor overlay window (aka COW), +we would leave a dangling pointer to that window in the CompScreen +structure, which will trigger a use-after-free later. + +Make sure to clear the CompScreen pointer to the COW when the latter gets +destroyed explicitly by the client. + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Olivier Fourdan +Reviewed-by: Adam Jackson +--- + composite/compwindow.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/composite/compwindow.c b/composite/compwindow.c +index 4e2494b86..b30da589e 100644 +--- a/composite/compwindow.c ++++ b/composite/compwindow.c +@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin) + ret = (*pScreen->DestroyWindow) (pWin); + cs->DestroyWindow = pScreen->DestroyWindow; + pScreen->DestroyWindow = compDestroyWindow; ++ ++ /* Did we just destroy the overlay window? */ ++ if (pWin == cs->pOverlayWin) ++ cs->pOverlayWin = NULL; ++ + /* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ + return ret; + } +-- +2.40.0 + diff --git a/SPECS/tigervnc.spec b/SPECS/tigervnc.spec index e42b633..e166d04 100644 --- a/SPECS/tigervnc.spec +++ b/SPECS/tigervnc.spec @@ -5,7 +5,7 @@ Name: tigervnc Version: 1.12.0 -Release: 9%{?dist}.2 +Release: 15%{?dist} Summary: A TigerVNC remote display system %global _hardened_build 1 @@ -33,14 +33,15 @@ Patch54: tigervnc-fix-ghost-cursor-in-zaphod-mode.patch # https://github.com/TigerVNC/tigervnc/pull/1510 Patch55: tigervnc-add-new-keycodes-for-unknown-keysyms.patch Patch56: tigervnc-sanity-check-when-cleaning-up-keymap-changes.patch +Patch57: tigervnc-selinux-allow-vncsession-create-vnc-directory.patch # This is tigervnc-%%{version}/unix/xserver116.patch rebased on the latest xorg Patch100: tigervnc-xserver120.patch # 1326867 - [RHEL7.3] GLX applications in an Xvnc session fails to start Patch101: 0001-rpath-hack.patch -# CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation -Patch110: xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch +# CVE-2023-1393 tigervnc: xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability +Patch110: xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch BuildRequires: gcc-c++ BuildRequires: libX11-devel, automake, autoconf, libtool, gettext, gettext-autopoint @@ -163,7 +164,7 @@ for all in `find . -type f -perm -001`; do done %patch100 -p1 -b .xserver120-rebased %patch101 -p1 -b .rpath -%patch110 -p1 -b .Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch +%patch110 -p1 -b .composite-Fix-use-after-free-of-the-COW popd %patch1 -p1 -b .use-gnome-as-default-session @@ -176,6 +177,7 @@ popd %patch54 -p1 -b .fix-ghost-cursor-in-zaphod-mode %patch55 -p1 -b .add-new-keycodes-for-unknown-keysyms %patch56 -p1 -b .sanity-check-when-cleaning-up-keymap-changes +%patch57 -p1 -b .selinux-allow-vncsession-create-vnc-directory %build %ifarch sparcv9 sparc64 s390 s390x @@ -330,17 +332,41 @@ fi %ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename} %changelog -* Wed Feb 15 2023 Jan Grulich - 1.12.0-9.2 +*Mon Mar 27 2023 Jan Grulich - 1.12.0-15 +- xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability + Resolves: bz#2180305 + +* Tue Feb 21 2023 Jan Grulich - 1.12.0-14 +- SELinux: allow vncsession create .vnc directory + Resolves: bz#2164704 + +* Wed Feb 15 2023 Jan Grulich - 1.12.0-13 - Add sanity check when cleaning up keymap changes - Resolves: bz#2169962 + Resolves: bz#2169960 -* Mon Feb 06 2023 Jan Grulich - 1.12.0-9.1 +* Mon Feb 06 2023 Jan Grulich - 1.12.0-12 - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation - Resolves: bz#2167057 + Resolves: bz#2167058 -* Tue Dec 06 2022 Jan Grulich - 1.12.0-8 +* Tue Dec 20 2022 Tomas Popela - 1.12.0-11 +- Rebuild for xorg-x11-server CVE-2022-46340 follow up fix + +* Fri Dec 16 2022 Jan Grulich - 1.12.0-10 +- Rebuild for xorg-x11-server CVEs + Resolves: CVE-2022-4283 (bz#2154233) + Resolves: CVE-2022-46340 (bz#2154220) + Resolves: CVE-2022-46341 (bz#2154223) + Resolves: CVE-2022-46342 (bz#2154225) + Resolves: CVE-2022-46343 (bz#2154227) + Resolves: CVE-2022-46344 (bz#2154229) + +* Thu Dec 08 2022 Jan Grulich - 1.12.0-9 +- Bump build version to fix upgrade path + Resolves: bz#1437569 + +* Fri Nov 18 2022 Jan Grulich - 1.12.0-8 - x0vncserver: add new keysym in case we don't find matching keycode - Resolves: bz#2150915 + Resolves: bz#1437569 * Wed Aug 24 2022 Jan Grulich - 1.12.0-7 - x0vncserver: fix ghost cursor in zaphod mode (better version)