From ad8b6b1e0f05dde8f831b6481723e2e936b2cbab Mon Sep 17 00:00:00 2001 From: eabdullin Date: Mon, 23 Jun 2025 10:22:44 +0000 Subject: [PATCH] Import from CS git --- .gitignore | 2 +- ...der-Avoid-0-or-less-animated-cursors.patch | 87 ++++++++++++++++++ ...low-the-integer-size-with-BigRequest.patch | 89 +++++++++++++++++++ ...nteger-overflow-on-BigRequest-length.patch | 35 ++++++++ ...ytes-to-ignore-when-sharing-input-bu.patch | 46 ++++++++++ ...-overflow-in-RecordSanityCheckRegist.patch | 62 +++++++++++++ ...overflow-in-RRChangeProviderProperty.patch | 41 +++++++++ SPECS/xorg-x11-server-Xwayland.spec | 18 +++- 8 files changed, 378 insertions(+), 2 deletions(-) create mode 100644 SOURCES/0001-render-Avoid-0-or-less-animated-cursors.patch create mode 100644 SOURCES/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch create mode 100644 SOURCES/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch create mode 100644 SOURCES/0004-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch create mode 100644 SOURCES/0005-record-Check-for-overflow-in-RecordSanityCheckRegist.patch create mode 100644 SOURCES/0006-randr-Check-for-overflow-in-RRChangeProviderProperty.patch diff --git a/.gitignore b/.gitignore index 36c8e62..9ae5e45 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/xwayland-21.1.3.tar.xz \ No newline at end of file +SOURCES/xwayland-21.1.3.tar.xz diff --git a/SOURCES/0001-render-Avoid-0-or-less-animated-cursors.patch b/SOURCES/0001-render-Avoid-0-or-less-animated-cursors.patch new file mode 100644 index 0000000..fc8a440 --- /dev/null +++ b/SOURCES/0001-render-Avoid-0-or-less-animated-cursors.patch @@ -0,0 +1,87 @@ +From 1d154fa2d5c52fa144c9cf0499affeba7be4f29e Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Fri, 28 Mar 2025 09:43:52 +0100 +Subject: [PATCH xserver 1/6] render: Avoid 0 or less animated cursors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Animated cursors use a series of cursors that the client can set. + +By default, the Xserver assumes at least one cursor is specified +while a client may actually pass no cursor at all. + +That causes an out-of-bound read creating the animated cursor and a +crash of the Xserver: + + | Invalid read of size 8 + | at 0x5323F4: AnimCursorCreate (animcur.c:325) + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd + | at 0x48468D3: reallocarray (vg_replace_malloc.c:1803) + | by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | + | Invalid read of size 2 + | at 0x5323F7: AnimCursorCreate (animcur.c:325) + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | Address 0x8 is not stack'd, malloc'd or (recently) free'd + +To avoid the issue, check the number of cursors specified and return a +BadValue error in both the proc handler (early) and the animated cursor +creation (as this is a public function) if there is 0 or less cursor. + +CVE-2025-49175 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: José Expósito +(cherry picked from commit 9304e31035f97ddbfcc1d5f3c178da1d04a472ad) +--- + render/animcur.c | 3 +++ + render/render.c | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/render/animcur.c b/render/animcur.c +index ef27bda27..77942d846 100644 +--- a/render/animcur.c ++++ b/render/animcur.c +@@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor, + int rc = BadAlloc, i; + AnimCurPtr ac; + ++ if (ncursor <= 0) ++ return BadValue; ++ + for (i = 0; i < screenInfo.numScreens; i++) + if (!GetAnimCurScreen(screenInfo.screens[i])) + return BadImplementation; +diff --git a/render/render.c b/render/render.c +index 456f156d4..e9bbac62d 100644 +--- a/render/render.c ++++ b/render/render.c +@@ -1788,6 +1788,8 @@ ProcRenderCreateAnimCursor(ClientPtr client) + ncursor = + (client->req_len - + (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1; ++ if (ncursor <= 0) ++ return BadValue; + cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32)); + if (!cursors) + return BadAlloc; +-- +2.49.0 + diff --git a/SOURCES/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch b/SOURCES/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch new file mode 100644 index 0000000..1283242 --- /dev/null +++ b/SOURCES/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch @@ -0,0 +1,89 @@ +From 6049e1b120c1aa93f23781c0976b1aad64f05f10 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 7 Apr 2025 16:13:34 +0200 +Subject: [PATCH xserver 2/6] os: Do not overflow the integer size with + BigRequest +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The BigRequest extension allows request larger than the 16-bit length +limit. + +It uses integers for the request length and checks for the size not to +exceed the maxBigRequestSize limit, but does so after translating the +length to integer by multiplying the given size in bytes by 4. + +In doing so, it might overflow the integer size limit before actually +checking for the overflow, defeating the purpose of the test. + +To avoid the issue, make sure to check that the request size does not +overflow the maxBigRequestSize limit prior to any conversion. + +The caller Dispatch() function however expects the return value to be in +bytes, so we cannot just return the converted value in case of error, as +that would also overflow the integer size. + +To preserve the existing API, we use a negative value for the X11 error +code BadLength as the function only return positive values, 0 or -1 and +update the caller Dispatch() function to take that case into account to +return the error code to the offending client. + +CVE-2025-49176 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Michel Dänzer +(cherry picked from commit b380b0a6c2022fbd3115552b1cd88251b5268daa) +--- + dix/dispatch.c | 9 +++++---- + os/io.c | 4 ++++ + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/dix/dispatch.c b/dix/dispatch.c +index ba01de6cf..c71098ce9 100644 +--- a/dix/dispatch.c ++++ b/dix/dispatch.c +@@ -464,9 +464,10 @@ Dispatch(void) + + /* now, finally, deal with client requests */ + result = ReadRequestFromClient(client); +- if (result <= 0) { +- if (result < 0) +- CloseDownClient(client); ++ if (result == 0) ++ break; ++ else if (result == -1) { ++ CloseDownClient(client); + break; + } + +@@ -487,7 +488,7 @@ Dispatch(void) + client->index, + client->requestBuffer); + #endif +- if (result > (maxBigRequestSize << 2)) ++ if (result < 0 || result > (maxBigRequestSize << 2)) + result = BadLength; + else { + result = XaceHookDispatch(client, client->majorOp); +diff --git a/os/io.c b/os/io.c +index 5b7fac349..5fc05821c 100644 +--- a/os/io.c ++++ b/os/io.c +@@ -296,6 +296,10 @@ ReadRequestFromClient(ClientPtr client) + needed = get_big_req_len(request, client); + } + client->req_len = needed; ++ if (needed > MAXINT >> 2) { ++ /* Check for potential integer overflow */ ++ return -(BadLength); ++ } + needed <<= 2; /* needed is in bytes now */ + } + if (gotnow < needed) { +-- +2.49.0 + diff --git a/SOURCES/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch b/SOURCES/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch new file mode 100644 index 0000000..36ded15 --- /dev/null +++ b/SOURCES/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch @@ -0,0 +1,35 @@ +From 205be7f7bf6850b364e9f10fe9f27ce6360670c9 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Wed, 18 Jun 2025 08:39:02 +0200 +Subject: [PATCH xserver 3/6] os: Check for integer overflow on BigRequest + length + +Check for another possible integer overflow once we get a complete xReq +with BigRequest. + +Related to CVE-2025-49176 + +Signed-off-by: Olivier Fourdan +Suggested-by: Peter Harris +Part-of: +(cherry picked from commit 4fc4d76b2c7aaed61ed2653f997783a3714c4fe1) +--- + os/io.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/os/io.c b/os/io.c +index 5fc05821c..064d69ea3 100644 +--- a/os/io.c ++++ b/os/io.c +@@ -395,6 +395,8 @@ ReadRequestFromClient(ClientPtr client) + needed = get_big_req_len(request, client); + } + client->req_len = needed; ++ if (needed > MAXINT >> 2) ++ return -(BadLength); + needed <<= 2; + } + if (gotnow < needed) { +-- +2.49.0 + diff --git a/SOURCES/0004-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch b/SOURCES/0004-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch new file mode 100644 index 0000000..133ce6f --- /dev/null +++ b/SOURCES/0004-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch @@ -0,0 +1,46 @@ +From 9cd6d7efb87d6d51a9ddce152d103ac087287c52 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 28 Apr 2025 10:46:03 +0200 +Subject: [PATCH xserver 4/6] os: Account for bytes to ignore when sharing + input buffer + +When reading requests from the clients, the input buffer might be shared +and used between different clients. + +If a given client sends a full request with non-zero bytes to ignore, +the bytes to ignore may still be non-zero even though the request is +full, in which case the buffer could be shared with another client who's +request will not be processed because of those bytes to ignore, leading +to a possible hang of the other client request. + +To avoid the issue, make sure we have zero bytes to ignore left in the +input request when sharing the input buffer with another client. + +CVE-2025-49178 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +(cherry picked from commit b0c1cbf4f8e6baa372b1676d2f30512de8ab4ed3) +--- + os/io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/os/io.c b/os/io.c +index 064d69ea3..83986af92 100644 +--- a/os/io.c ++++ b/os/io.c +@@ -444,7 +444,7 @@ ReadRequestFromClient(ClientPtr client) + */ + + gotnow -= needed; +- if (!gotnow) ++ if (!gotnow && !oci->ignoreBytes) + AvailableInput = oc; + if (move_header) { + if (client->req_len < bytes_to_int32(sizeof(xBigReq) - sizeof(xReq))) { +-- +2.49.0 + diff --git a/SOURCES/0005-record-Check-for-overflow-in-RecordSanityCheckRegist.patch b/SOURCES/0005-record-Check-for-overflow-in-RecordSanityCheckRegist.patch new file mode 100644 index 0000000..db96f42 --- /dev/null +++ b/SOURCES/0005-record-Check-for-overflow-in-RecordSanityCheckRegist.patch @@ -0,0 +1,62 @@ +From acc5a83e0d813403fa0377d9ed405c3ca2f9a39d Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 28 Apr 2025 11:47:15 +0200 +Subject: [PATCH xserver 5/6] record: Check for overflow in + RecordSanityCheckRegisterClients() + +The RecordSanityCheckRegisterClients() checks for the request length, +but does not check for integer overflow. + +A client might send a very large value for either the number of clients +or the number of protocol ranges that will cause an integer overflow in +the request length computation, defeating the check for request length. + +To avoid the issue, explicitly check the number of clients against the +limit of clients (which is much lower than an maximum integer value) and +the number of protocol ranges (multiplied by the record length) do not +exceed the maximum integer value. + +This way, we ensure that the final computation for the request length +will not overflow the maximum integer limit. + +CVE-2025-49179 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +(cherry picked from commit ea52403bf222f8bd6ee4c509bed5e34f0c789b00) +--- + record/record.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/record/record.c b/record/record.c +index e123867a7..018e53f81 100644 +--- a/record/record.c ++++ b/record/record.c +@@ -45,6 +45,7 @@ and Jim Haggerty of Metheus. + #include "inputstr.h" + #include "eventconvert.h" + #include "scrnintstr.h" ++#include "opaque.h" + + #include + #include +@@ -1298,6 +1299,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client, + int i; + XID recordingClient; + ++ /* LimitClients is 2048 at max, way less that MAXINT */ ++ if (stuff->nClients > LimitClients) ++ return BadValue; ++ ++ if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange)) ++ return BadValue; ++ + if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) != + 4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges) + return BadLength; +-- +2.49.0 + diff --git a/SOURCES/0006-randr-Check-for-overflow-in-RRChangeProviderProperty.patch b/SOURCES/0006-randr-Check-for-overflow-in-RRChangeProviderProperty.patch new file mode 100644 index 0000000..8e32d58 --- /dev/null +++ b/SOURCES/0006-randr-Check-for-overflow-in-RRChangeProviderProperty.patch @@ -0,0 +1,41 @@ +From b33673deffe92ff7d5b4be5dd944eed2718ee3a0 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Tue, 20 May 2025 15:18:19 +0200 +Subject: [PATCH xserver 6/6] randr: Check for overflow in + RRChangeProviderProperty() + +A client might send a request causing an integer overflow when computing +the total size to allocate in RRChangeProviderProperty(). + +To avoid the issue, check that total length in bytes won't exceed the +maximum integer value. + +CVE-2025-49180 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +(cherry picked from commit 1b0bf563a3a76b06ddcd6fc4d8e72d81f6773699) +--- + randr/rrproviderproperty.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c +index b79c17f9b..7088570ee 100644 +--- a/randr/rrproviderproperty.c ++++ b/randr/rrproviderproperty.c +@@ -179,7 +179,8 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type, + + if (mode == PropModeReplace || len > 0) { + void *new_data = NULL, *old_data = NULL; +- ++ if (total_len > MAXINT / size_in_bytes) ++ return BadValue; + total_size = total_len * size_in_bytes; + new_value.data = (void *) malloc(total_size); + if (!new_value.data && total_size) { +-- +2.49.0 + diff --git a/SPECS/xorg-x11-server-Xwayland.spec b/SPECS/xorg-x11-server-Xwayland.spec index d1800d4..5fbca42 100644 --- a/SPECS/xorg-x11-server-Xwayland.spec +++ b/SPECS/xorg-x11-server-Xwayland.spec @@ -9,7 +9,7 @@ Summary: Xwayland Name: xorg-x11-server-Xwayland Version: 21.1.3 -Release: 17%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} +Release: 18%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} URL: http://www.x.org %if 0%{?gitdate} @@ -94,6 +94,17 @@ Patch10043: 0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch Patch10044: 0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch # Fix for CVE-2024-9632 Patch10045: 0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch +# CVE-2025-49175: Out-of-bounds access in X Rendering extension +Patch10046: 0001-render-Avoid-0-or-less-animated-cursors.patch +# CVE-2025-49176: Integer overflow in Big Requests Extension +Patch10047: 0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch +Patch10048: 0003-os-Check-for-integer-overflow-on-BigRequest-length.patch +# CVE-2025-49178: Unprocessed client request via bytes to ignore +Patch10049: 0004-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch +# CVE-2025-49179: Integer overflow in X Record extension +Patch10050: 0005-record-Check-for-overflow-in-RecordSanityCheckRegist.patch +# CVE-2025-49180: Integer overflow in RandR extension +Patch10051: 0006-randr-Check-for-overflow-in-RRChangeProviderProperty.patch License: MIT @@ -201,6 +212,11 @@ rm -Rf $RPM_BUILD_ROOT%{_localstatedir}/lib/xkb %{_libdir}/pkgconfig/xwayland.pc %changelog +* Wed Jun 18 2025 Olivier Fourdan - 21.1.3-18 +- CVE fix for: CVE-2025-49175 (RHEL-97278), CVE-2025-49176 (RHEL-97299, + CVE-2025-49178 (RHEL-97374), CVE-2025-49179 (RHEL-97417), + CVE-2025-49180 (RHEL-97249) + * Wed Oct 30 2024 Olivier Fourdan - 21.1.3-17 - Fix for CVE-2024-9632 - (RHEL-61995)