From c54d103897699579433785c1bcd9c8cb7dd0d115 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Wed, 30 Oct 2024 09:54:51 +0100 Subject: [PATCH] Fix for CVE-2024-9632 Resolves: https://issues.redhat.com/browse/RHEL-61995 --- ...-buffer-overflow-in-_XkbSetCompatMap.patch | 57 +++++++++++++++++++ xorg-x11-server-Xwayland.spec | 7 ++- 2 files changed, 63 insertions(+), 1 deletion(-) create mode 100644 0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch diff --git a/0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch b/0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch new file mode 100644 index 0000000..dc75736 --- /dev/null +++ b/0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch @@ -0,0 +1,57 @@ +From 26120df7aae6b5bf8086fb4d871d3b1a07ddacdb Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb +Date: Thu, 10 Oct 2024 10:37:28 +0200 +Subject: [PATCH xserver] xkb: Fix buffer overflow in _XkbSetCompatMap() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The _XkbSetCompatMap() function attempts to resize the `sym_interpret` +buffer. + +However, It didn't update its size properly. It updated `num_si` only, +without updating `size_si`. + +This may lead to local privilege escalation if the server is run as root +or remote code execution (e.g. x11 over ssh). + +CVE-2024-9632, ZDI-CAN-24756 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Reviewed-by: Peter Hutterer +Tested-by: Peter Hutterer +Reviewed-by: José Expósito +(cherry picked from commit 85b776571487f52e756f68a069c768757369bfe3) + +Part-of: +--- + xkb/xkb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index 8d52e25df..8b63e34b5 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev, + XkbSymInterpretPtr sym; + unsigned int skipped = 0; + +- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) { +- compat->num_si = req->firstSI + req->nSI; ++ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) { ++ compat->num_si = compat->size_si = req->firstSI + req->nSI; + compat->sym_interpret = reallocarray(compat->sym_interpret, +- compat->num_si, ++ compat->size_si, + sizeof(XkbSymInterpretRec)); + if (!compat->sym_interpret) { +- compat->num_si = 0; ++ compat->num_si = compat->size_si = 0; + return BadAlloc; + } + } +-- +2.47.0 + diff --git a/xorg-x11-server-Xwayland.spec b/xorg-x11-server-Xwayland.spec index 8321841..d1800d4 100644 --- a/xorg-x11-server-Xwayland.spec +++ b/xorg-x11-server-Xwayland.spec @@ -9,7 +9,7 @@ Summary: Xwayland Name: xorg-x11-server-Xwayland Version: 21.1.3 -Release: 16%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} +Release: 17%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} URL: http://www.x.org %if 0%{?gitdate} @@ -92,6 +92,8 @@ Patch10043: 0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch # Fix for the fix for CVE-2024-31083 # https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659 Patch10044: 0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch +# Fix for CVE-2024-9632 +Patch10045: 0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch License: MIT @@ -199,6 +201,9 @@ rm -Rf $RPM_BUILD_ROOT%{_localstatedir}/lib/xkb %{_libdir}/pkgconfig/xwayland.pc %changelog +* Wed Oct 30 2024 Olivier Fourdan - 21.1.3-17 +- Fix for CVE-2024-9632 - (RHEL-61995) + * Thu Apr 4 2024 Olivier Fourdan - 21.1.3-16 - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31083