rpms/xorg-x11-server-Xwayland
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix for CVE-2024-9632

Browse Source 
Resolves: https://issues.redhat.com/browse/RHEL-61995
This commit is contained in:
Olivier Fourdan 2024-10-30 09:54:51 +01:00
parent 5937c4b23f
commit c54d103897
2 changed files with 63 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch Normal file
View File

@ -0,0 +1,57 @@
From 26120df7aae6b5bf8086fb4d871d3b1a07ddacdb Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@herrb.eu>
Date: Thu, 10 Oct 2024 10:37:28 +0200
Subject: [PATCH xserver] xkb: Fix buffer overflow in _XkbSetCompatMap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.
However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.
This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).
CVE-2024-9632, ZDI-CAN-24756
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: José Expósito <jexposit@redhat.com>
(cherry picked from commit 85b776571487f52e756f68a069c768757369bfe3)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1735>
---
xkb/xkb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 8d52e25df..8b63e34b5 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
XkbSymInterpretPtr sym;
unsigned int skipped = 0;
- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
- compat->num_si = req->firstSI + req->nSI;
+ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
+ compat->num_si = compat->size_si = req->firstSI + req->nSI;
compat->sym_interpret = reallocarray(compat->sym_interpret,
- compat->num_si,
+ compat->size_si,
sizeof(XkbSymInterpretRec));
if (!compat->sym_interpret) {
- compat->num_si = 0;
+ compat->num_si = compat->size_si = 0;
return BadAlloc;
}
}
--
2.47.0

7
xorg-x11-server-Xwayland.spec
View File

@ -9,7 +9,7 @@
Summary: Xwayland
Name: xorg-x11-server-Xwayland
Version: 21.1.3
Release: 16%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist}
Release: 17%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist}
URL: http://www.x.org
%if 0%{?gitdate}
@ -92,6 +92,8 @@ Patch10043: 0004-render-fix-refcounting-of-glyphs-during-ProcRenderAd.patch
# Fix for the fix for CVE-2024-31083
# https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659
Patch10044: 0001-render-Avoid-possible-double-free-in-ProcRenderAddGl.patch
# Fix for CVE-2024-9632
Patch10045: 0001-xkb-Fix-buffer-overflow-in-_XkbSetCompatMap.patch
License: MIT
@ -199,6 +201,9 @@ rm -Rf $RPM_BUILD_ROOT%{_localstatedir}/lib/xkb
%{_libdir}/pkgconfig/xwayland.pc
%changelog
* Wed Oct 30 2024 Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-17
- Fix for CVE-2024-9632 - (RHEL-61995)
* Thu Apr 4 2024 Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-16
- CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31083