From 87b77835e5d69b9599dd39d3835db7d08861d196 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Fri, 7 Jan 2022 11:23:58 +0100 Subject: [PATCH] Fix CVE-2021-4008, CVE-2021-4009, CVE-2021-4010, CVE-2021-4011 Resolves: rhbz#2038067 Resolves: rhbz#2038070 Resolves: rhbz#2038072 Resolves: rhbz#2038074 --- ...f-bounds-access-in-SwapCreateRegiste.patch | 35 ++++++++++++ ...f-bounds-access-in-ProcXFixesCreateP.patch | 44 +++++++++++++++ ...bounds-access-in-SProcScreenSaverSus.patch | 34 ++++++++++++ ...f-bounds-access-in-SProcRenderCompos.patch | 53 +++++++++++++++++++ xorg-x11-server-Xwayland.spec | 15 +++++- 5 files changed, 180 insertions(+), 1 deletion(-) create mode 100644 0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch create mode 100644 0002-xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch create mode 100644 0003-Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch create mode 100644 0004-render-Fix-out-of-bounds-access-in-SProcRenderCompos.patch diff --git a/0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch b/0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch new file mode 100644 index 0000000..83e4ce2 --- /dev/null +++ b/0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch @@ -0,0 +1,35 @@ +From a8644465d98beb08759546711b77bb617861c67f Mon Sep 17 00:00:00 2001 +From: Povilas Kanapickas +Date: Tue, 14 Dec 2021 15:00:00 +0200 +Subject: [PATCH xserver 1/4] record: Fix out of bounds access in + SwapCreateRegister() + +ZDI-CAN-14952, CVE-2021-4011 + +This vulnerability was discovered and the fix was suggested by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Povilas Kanapickas +(cherry picked from commit e56f61c79fc3cee26d83cda0f84ae56d5979f768) +--- + record/record.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/record/record.c b/record/record.c +index be154525d..e123867a7 100644 +--- a/record/record.c ++++ b/record/record.c +@@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff) + swapl(pClientID); + } + if (stuff->nRanges > +- client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq) +- - stuff->nClients) ++ (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq) ++ - stuff->nClients) / bytes_to_int32(sz_xRecordRange)) + return BadLength; + RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges); + return Success; +-- +2.33.1 + diff --git a/0002-xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch b/0002-xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch new file mode 100644 index 0000000..fe4f283 --- /dev/null +++ b/0002-xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch @@ -0,0 +1,44 @@ +From 3eb5445f6f7fa9f86de87adc768105d42bdbcf74 Mon Sep 17 00:00:00 2001 +From: Povilas Kanapickas +Date: Tue, 14 Dec 2021 15:00:01 +0200 +Subject: [PATCH xserver 2/4] xfixes: Fix out of bounds access in + *ProcXFixesCreatePointerBarrier() + +ZDI-CAN-14950, CVE-2021-4009 + +This vulnerability was discovered and the fix was suggested by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Povilas Kanapickas +(cherry picked from commit b5196750099ae6ae582e1f46bd0a6dad29550e02) +--- + xfixes/cursor.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/xfixes/cursor.c b/xfixes/cursor.c +index 60580b88f..c5d4554b2 100644 +--- a/xfixes/cursor.c ++++ b/xfixes/cursor.c +@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client) + { + REQUEST(xXFixesCreatePointerBarrierReq); + +- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices)); ++ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, ++ pad_to_int32(stuff->num_devices * sizeof(CARD16))); + LEGAL_NEW_RESOURCE(stuff->barrier, client); + + return XICreatePointerBarrier(client, stuff); +@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client) + + swaps(&stuff->length); + swaps(&stuff->num_devices); +- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, pad_to_int32(stuff->num_devices)); ++ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq, ++ pad_to_int32(stuff->num_devices * sizeof(CARD16))); + + swapl(&stuff->barrier); + swapl(&stuff->window); +-- +2.33.1 + diff --git a/0003-Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch b/0003-Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch new file mode 100644 index 0000000..60f2218 --- /dev/null +++ b/0003-Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch @@ -0,0 +1,34 @@ +From fe0c050276c09f43cc1ae80b4553db42398ca84c Mon Sep 17 00:00:00 2001 +From: Povilas Kanapickas +Date: Tue, 14 Dec 2021 15:00:02 +0200 +Subject: [PATCH xserver 3/4] Xext: Fix out of bounds access in + SProcScreenSaverSuspend() + +ZDI-CAN-14951, CVE-2021-4010 + +This vulnerability was discovered and the fix was suggested by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Povilas Kanapickas +(cherry picked from commit 6c4c53010772e3cb4cb8acd54950c8eec9c00d21) +--- + Xext/saver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Xext/saver.c b/Xext/saver.c +index 1d7e3cadf..f813ba08d 100644 +--- a/Xext/saver.c ++++ b/Xext/saver.c +@@ -1351,8 +1351,8 @@ SProcScreenSaverSuspend(ClientPtr client) + REQUEST(xScreenSaverSuspendReq); + + swaps(&stuff->length); +- swapl(&stuff->suspend); + REQUEST_SIZE_MATCH(xScreenSaverSuspendReq); ++ swapl(&stuff->suspend); + return ProcScreenSaverSuspend(client); + } + +-- +2.33.1 + diff --git a/0004-render-Fix-out-of-bounds-access-in-SProcRenderCompos.patch b/0004-render-Fix-out-of-bounds-access-in-SProcRenderCompos.patch new file mode 100644 index 0000000..59c0762 --- /dev/null +++ b/0004-render-Fix-out-of-bounds-access-in-SProcRenderCompos.patch @@ -0,0 +1,53 @@ +From 59c977bff66de77bd93ce8853e33e1b4ca661a49 Mon Sep 17 00:00:00 2001 +From: Povilas Kanapickas +Date: Tue, 14 Dec 2021 15:00:03 +0200 +Subject: [PATCH xserver 4/4] render: Fix out of bounds access in + SProcRenderCompositeGlyphs() + +ZDI-CAN-14192, CVE-2021-4008 + +This vulnerability was discovered and the fix was suggested by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Povilas Kanapickas +(cherry picked from commit ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60) +--- + render/render.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/render/render.c b/render/render.c +index c376090ca..456f156d4 100644 +--- a/render/render.c ++++ b/render/render.c +@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client) + + i = elt->len; + if (i == 0xff) { ++ if (buffer + 4 > end) { ++ return BadLength; ++ } + swapl((int *) buffer); + buffer += 4; + } +@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client) + buffer += i; + break; + case 2: ++ if (buffer + i * 2 > end) { ++ return BadLength; ++ } + while (i--) { + swaps((short *) buffer); + buffer += 2; + } + break; + case 4: ++ if (buffer + i * 4 > end) { ++ return BadLength; ++ } + while (i--) { + swapl((int *) buffer); + buffer += 4; +-- +2.33.1 + diff --git a/xorg-x11-server-Xwayland.spec b/xorg-x11-server-Xwayland.spec index 1c696e7..6b13629 100644 --- a/xorg-x11-server-Xwayland.spec +++ b/xorg-x11-server-Xwayland.spec @@ -9,7 +9,7 @@ Summary: Xwayland Name: xorg-x11-server-Xwayland Version: 21.1.3 -Release: 1%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} +Release: 2%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} URL: http://www.x.org %if 0%{?gitdate} @@ -23,6 +23,15 @@ Patch2: 0002-xwayland-glamor-Change-errors-to-verbose-messages.patch Patch3: 0003-xwayland-glamor-Log-backend-selected-for-debug.patch Patch4: 0004-xwayland-eglstream-Prefer-EGLstream-if-available.patch +# CVE-2021-4011 +Patch10001: 0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch +# CVE-2021-4009 +Patch10002: 0002-xfixes-Fix-out-of-bounds-access-in-ProcXFixesCreateP.patch +# CVE-2021-4010 +Patch10003: 0003-Xext-Fix-out-of-bounds-access-in-SProcScreenSaverSus.patch +# CVE-2021-4008 +Patch10004: 0004-render-Fix-out-of-bounds-access-in-SProcRenderCompos.patch + License: MIT Requires: xorg-x11-server-common @@ -128,6 +137,10 @@ rm -Rf $RPM_BUILD_ROOT%{_localstatedir}/lib/xkb %{_libdir}/pkgconfig/xwayland.pc %changelog +* Fri Jan 7 2022 Olivier Fourdan - 21.1.3-2 +- CVE fix for: CVE-2021-4008 (#2038067), CVE-2021-4009 (#2038070), + CVE-2021-4010 (#2038072), CVE-2021-4011 (#2038074) + * Thu Dec 2 2021 Olivier Fourdan - 21.1.3-1 - Rebase to 21.1.3 (rhbz#2015839) - Prefer EGLstream if both EGLstream and GBM are usable