Compare commits
3 Commits
5f6d86acaa
...
dafb9cbb36
Author | SHA1 | Date |
---|---|---|
José Expósito | dafb9cbb36 | |
José Expósito | d0ad6c3e40 | |
Olivier Fourdan | 324c7d6071 |
|
@ -0,0 +1 @@
|
||||||
|
86ae4add5719e6026a569f5559d51e8707171d5d xorg-server-1.20.11.tar.bz2
|
|
@ -0,0 +1,80 @@
|
||||||
|
From a31ba141824a7649e11f0ef7673718ce559d6337 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||||
|
Date: Tue, 3 Oct 2023 11:53:05 +1000
|
||||||
|
Subject: [PATCH xserver 1/4] Xi/randr: fix handling of PropModeAppend/Prepend
|
||||||
|
|
||||||
|
The handling of appending/prepending properties was incorrect, with at
|
||||||
|
least two bugs: the property length was set to the length of the new
|
||||||
|
part only, i.e. appending or prepending N elements to a property with P
|
||||||
|
existing elements always resulted in the property having N elements
|
||||||
|
instead of N + P.
|
||||||
|
|
||||||
|
Second, when pre-pending a value to a property, the offset for the old
|
||||||
|
values was incorrect, leaving the new property with potentially
|
||||||
|
uninitalized values and/or resulting in OOB memory writes.
|
||||||
|
For example, prepending a 3 element value to a 5 element property would
|
||||||
|
result in this 8 value array:
|
||||||
|
[N, N, N, ?, ?, P, P, P ] P, P
|
||||||
|
^OOB write
|
||||||
|
|
||||||
|
The XI2 code is a copy/paste of the RandR code, so the bug exists in
|
||||||
|
both.
|
||||||
|
|
||||||
|
CVE-2023-5367, ZDI-CAN-22153
|
||||||
|
|
||||||
|
This vulnerability was discovered by:
|
||||||
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||||
|
|
||||||
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||||
|
---
|
||||||
|
Xi/xiproperty.c | 4 ++--
|
||||||
|
randr/rrproperty.c | 4 ++--
|
||||||
|
2 files changed, 4 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
|
||||||
|
index 6ec419e870..563c4f31a5 100644
|
||||||
|
--- a/Xi/xiproperty.c
|
||||||
|
+++ b/Xi/xiproperty.c
|
||||||
|
@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
|
||||||
|
XIDestroyDeviceProperty(prop);
|
||||||
|
return BadAlloc;
|
||||||
|
}
|
||||||
|
- new_value.size = len;
|
||||||
|
+ new_value.size = total_len;
|
||||||
|
new_value.type = type;
|
||||||
|
new_value.format = format;
|
||||||
|
|
||||||
|
@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
|
||||||
|
case PropModePrepend:
|
||||||
|
new_data = new_value.data;
|
||||||
|
old_data = (void *) (((char *) new_value.data) +
|
||||||
|
- (prop_value->size * size_in_bytes));
|
||||||
|
+ (len * size_in_bytes));
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
if (new_data)
|
||||||
|
diff --git a/randr/rrproperty.c b/randr/rrproperty.c
|
||||||
|
index c2fb9585c6..25469f57b2 100644
|
||||||
|
--- a/randr/rrproperty.c
|
||||||
|
+++ b/randr/rrproperty.c
|
||||||
|
@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
|
||||||
|
RRDestroyOutputProperty(prop);
|
||||||
|
return BadAlloc;
|
||||||
|
}
|
||||||
|
- new_value.size = len;
|
||||||
|
+ new_value.size = total_len;
|
||||||
|
new_value.type = type;
|
||||||
|
new_value.format = format;
|
||||||
|
|
||||||
|
@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
|
||||||
|
case PropModePrepend:
|
||||||
|
new_data = new_value.data;
|
||||||
|
old_data = (void *) (((char *) new_value.data) +
|
||||||
|
- (prop_value->size * size_in_bytes));
|
||||||
|
+ (len * size_in_bytes));
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
if (new_data)
|
||||||
|
--
|
||||||
|
2.41.0
|
||||||
|
|
|
@ -0,0 +1,105 @@
|
||||||
|
From b98fc07d3442a289c6bef82df50dd0a2d01de71a Mon Sep 17 00:00:00 2001
|
||||||
|
From: Adam Jackson <ajax@redhat.com>
|
||||||
|
Date: Thu, 2 Feb 2023 12:26:27 -0500
|
||||||
|
Subject: [PATCH xserver] present: Send a PresentConfigureNotify event for
|
||||||
|
destroyed windows
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
This enables fixing a deadlock case on the client side, where the client
|
||||||
|
ends up blocked waiting for a Present event that will never come because
|
||||||
|
the window was destroyed. The new PresentWindowDestroyed flag allows the
|
||||||
|
client to avoid blocking indefinitely.
|
||||||
|
|
||||||
|
Signed-off-by: Adam Jackson <ajax@redhat.com>
|
||||||
|
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/116
|
||||||
|
See-also: https://gitlab.freedesktop.org/mesa/mesa/-/issues/6685
|
||||||
|
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
|
||||||
|
(cherry picked from commit 462b06033e66a32308d940eb5fc47f5e4c914dc0)
|
||||||
|
---
|
||||||
|
present/present_event.c | 5 +++--
|
||||||
|
present/present_priv.h | 7 ++++++-
|
||||||
|
present/present_screen.c | 11 ++++++++++-
|
||||||
|
3 files changed, 19 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/present/present_event.c b/present/present_event.c
|
||||||
|
index 435b26b70..849732dc8 100644
|
||||||
|
--- a/present/present_event.c
|
||||||
|
+++ b/present/present_event.c
|
||||||
|
@@ -102,7 +102,8 @@ present_event_swap(xGenericEvent *from, xGenericEvent *to)
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling)
|
||||||
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h,
|
||||||
|
+ int bw, WindowPtr sibling, CARD32 flags)
|
||||||
|
{
|
||||||
|
present_window_priv_ptr window_priv = present_window_priv(window);
|
||||||
|
|
||||||
|
@@ -122,7 +123,7 @@ present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw,
|
||||||
|
.off_y = 0,
|
||||||
|
.pixmap_width = w,
|
||||||
|
.pixmap_height = h,
|
||||||
|
- .pixmap_flags = 0
|
||||||
|
+ .pixmap_flags = flags
|
||||||
|
};
|
||||||
|
present_event_ptr event;
|
||||||
|
|
||||||
|
diff --git a/present/present_priv.h b/present/present_priv.h
|
||||||
|
index 6ebd009a2..4ad729864 100644
|
||||||
|
--- a/present/present_priv.h
|
||||||
|
+++ b/present/present_priv.h
|
||||||
|
@@ -43,6 +43,11 @@
|
||||||
|
#define DebugPresent(x)
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+/* XXX this belongs in presentproto */
|
||||||
|
+#ifndef PresentWindowDestroyed
|
||||||
|
+#define PresentWindowDestroyed (1 << 0)
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
extern int present_request;
|
||||||
|
|
||||||
|
extern DevPrivateKeyRec present_screen_private_key;
|
||||||
|
@@ -307,7 +312,7 @@ void
|
||||||
|
present_free_events(WindowPtr window);
|
||||||
|
|
||||||
|
void
|
||||||
|
-present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling);
|
||||||
|
+present_send_config_notify(WindowPtr window, int x, int y, int w, int h, int bw, WindowPtr sibling, CARD32 flags);
|
||||||
|
|
||||||
|
void
|
||||||
|
present_send_complete_notify(WindowPtr window, CARD8 kind, CARD8 mode, CARD32 serial, uint64_t ust, uint64_t msc);
|
||||||
|
diff --git a/present/present_screen.c b/present/present_screen.c
|
||||||
|
index 15684eda4..2c29aafd2 100644
|
||||||
|
--- a/present/present_screen.c
|
||||||
|
+++ b/present/present_screen.c
|
||||||
|
@@ -93,6 +93,15 @@ present_destroy_window(WindowPtr window)
|
||||||
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
||||||
|
present_window_priv_ptr window_priv = present_window_priv(window);
|
||||||
|
|
||||||
|
+ present_send_config_notify(window,
|
||||||
|
+ window->drawable.x,
|
||||||
|
+ window->drawable.y,
|
||||||
|
+ window->drawable.width,
|
||||||
|
+ window->drawable.height,
|
||||||
|
+ window->borderWidth,
|
||||||
|
+ window->nextSib,
|
||||||
|
+ PresentWindowDestroyed);
|
||||||
|
+
|
||||||
|
if (window_priv) {
|
||||||
|
present_clear_window_notifies(window);
|
||||||
|
present_free_events(window);
|
||||||
|
@@ -123,7 +132,7 @@ present_config_notify(WindowPtr window,
|
||||||
|
ScreenPtr screen = window->drawable.pScreen;
|
||||||
|
present_screen_priv_ptr screen_priv = present_screen_priv(screen);
|
||||||
|
|
||||||
|
- present_send_config_notify(window, x, y, w, h, bw, sibling);
|
||||||
|
+ present_send_config_notify(window, x, y, w, h, bw, sibling, 0);
|
||||||
|
|
||||||
|
unwrap(screen_priv, screen, ConfigNotify);
|
||||||
|
if (screen->ConfigNotify)
|
||||||
|
--
|
||||||
|
2.40.0
|
||||||
|
|
|
@ -0,0 +1,99 @@
|
||||||
|
From 004f461c440cb6611eefb48fbbb4fa53a6d49f80 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||||
|
Date: Thu, 5 Oct 2023 12:19:45 +1000
|
||||||
|
Subject: [PATCH xserver 2/4] mi: reset the PointerWindows reference on screen
|
||||||
|
switch
|
||||||
|
|
||||||
|
PointerWindows[] keeps a reference to the last window our sprite
|
||||||
|
entered - changes are usually handled by CheckMotion().
|
||||||
|
|
||||||
|
If we switch between screens via XWarpPointer our
|
||||||
|
dev->spriteInfo->sprite->win is set to the new screen's root window.
|
||||||
|
If there's another window at the cursor location CheckMotion() will
|
||||||
|
trigger the right enter/leave events later. If there is not, it skips
|
||||||
|
that process and we never trigger LeaveWindow() - PointerWindows[] for
|
||||||
|
the device still refers to the previous window.
|
||||||
|
|
||||||
|
If that window is destroyed we have a dangling reference that will
|
||||||
|
eventually cause a use-after-free bug when checking the window hierarchy
|
||||||
|
later.
|
||||||
|
|
||||||
|
To trigger this, we require:
|
||||||
|
- two protocol screens
|
||||||
|
- XWarpPointer to the other screen's root window
|
||||||
|
- XDestroyWindow before entering any other window
|
||||||
|
|
||||||
|
This is a niche bug so we hack around it by making sure we reset the
|
||||||
|
PointerWindows[] entry so we cannot have a dangling pointer. This
|
||||||
|
doesn't handle Enter/Leave events correctly but the previous code didn't
|
||||||
|
either.
|
||||||
|
|
||||||
|
CVE-2023-5380, ZDI-CAN-21608
|
||||||
|
|
||||||
|
This vulnerability was discovered by:
|
||||||
|
Sri working with Trend Micro Zero Day Initiative
|
||||||
|
|
||||||
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||||
|
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||||
|
---
|
||||||
|
dix/enterleave.h | 2 --
|
||||||
|
include/eventstr.h | 3 +++
|
||||||
|
mi/mipointer.c | 17 +++++++++++++++--
|
||||||
|
3 files changed, 18 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/dix/enterleave.h b/dix/enterleave.h
|
||||||
|
index 4b833d8a3b..e8af924c68 100644
|
||||||
|
--- a/dix/enterleave.h
|
||||||
|
+++ b/dix/enterleave.h
|
||||||
|
@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev,
|
||||||
|
|
||||||
|
extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
|
||||||
|
|
||||||
|
-extern void LeaveWindow(DeviceIntPtr dev);
|
||||||
|
-
|
||||||
|
extern void CoreFocusEvent(DeviceIntPtr kbd,
|
||||||
|
int type, int mode, int detail, WindowPtr pWin);
|
||||||
|
|
||||||
|
diff --git a/include/eventstr.h b/include/eventstr.h
|
||||||
|
index bf3b95fe4a..2bae3b0767 100644
|
||||||
|
--- a/include/eventstr.h
|
||||||
|
+++ b/include/eventstr.h
|
||||||
|
@@ -296,4 +296,7 @@ union _InternalEvent {
|
||||||
|
#endif
|
||||||
|
};
|
||||||
|
|
||||||
|
+extern void
|
||||||
|
+LeaveWindow(DeviceIntPtr dev);
|
||||||
|
+
|
||||||
|
#endif
|
||||||
|
diff --git a/mi/mipointer.c b/mi/mipointer.c
|
||||||
|
index 75be1aeeb8..b12ae9be1d 100644
|
||||||
|
--- a/mi/mipointer.c
|
||||||
|
+++ b/mi/mipointer.c
|
||||||
|
@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y)
|
||||||
|
#ifdef PANORAMIX
|
||||||
|
&& noPanoramiXExtension
|
||||||
|
#endif
|
||||||
|
- )
|
||||||
|
- UpdateSpriteForScreen(pDev, pScreen);
|
||||||
|
+ ) {
|
||||||
|
+ DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
|
||||||
|
+ /* Hack for CVE-2023-5380: if we're moving
|
||||||
|
+ * screens PointerWindows[] keeps referring to the
|
||||||
|
+ * old window. If that gets destroyed we have a UAF
|
||||||
|
+ * bug later. Only happens when jumping from a window
|
||||||
|
+ * to the root window on the other screen.
|
||||||
|
+ * Enter/Leave events are incorrect for that case but
|
||||||
|
+ * too niche to fix.
|
||||||
|
+ */
|
||||||
|
+ LeaveWindow(pDev);
|
||||||
|
+ if (master)
|
||||||
|
+ LeaveWindow(master);
|
||||||
|
+ UpdateSpriteForScreen(pDev, pScreen);
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
--
|
||||||
|
2.41.0
|
||||||
|
|
|
@ -42,7 +42,7 @@
|
||||||
Summary: X.Org X11 X server
|
Summary: X.Org X11 X server
|
||||||
Name: xorg-x11-server
|
Name: xorg-x11-server
|
||||||
Version: 1.20.11
|
Version: 1.20.11
|
||||||
Release: 18%{?gitdate:.%{gitdate}}%{?dist}
|
Release: 21%{?gitdate:.%{gitdate}}%{?dist}
|
||||||
URL: http://www.x.org
|
URL: http://www.x.org
|
||||||
License: MIT
|
License: MIT
|
||||||
|
|
||||||
|
@ -119,6 +119,7 @@ Patch112: 0001-present-Check-for-NULL-to-prevent-crash.patch
|
||||||
# Fix a regression with hybrid gfx and NVIDIA proprietary driver
|
# Fix a regression with hybrid gfx and NVIDIA proprietary driver
|
||||||
# https://bugzilla.redhat.com/show_bug.cgi?id=2052605
|
# https://bugzilla.redhat.com/show_bug.cgi?id=2052605
|
||||||
Patch113: 0001-modesetting-Fix-msSharePixmapBacking-Segfault-Regres.patch
|
Patch113: 0001-modesetting-Fix-msSharePixmapBacking-Segfault-Regres.patch
|
||||||
|
Patch114: 0001-present-Send-a-PresentConfigureNotify-event-for-dest.patch
|
||||||
|
|
||||||
# CVE-2021-4011
|
# CVE-2021-4011
|
||||||
Patch10009: 0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
|
Patch10009: 0001-record-Fix-out-of-bounds-access-in-SwapCreateRegiste.patch
|
||||||
|
@ -156,6 +157,10 @@ Patch10025: 0008-Xext-fix-invalid-event-type-mask-in-XTestSwapFakeInp.patch
|
||||||
Patch10026: 0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
|
Patch10026: 0001-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
|
||||||
# CVE-2023-1393
|
# CVE-2023-1393
|
||||||
Patch10027: 0001-composite-Fix-use-after-free-of-the-COW.patch
|
Patch10027: 0001-composite-Fix-use-after-free-of-the-COW.patch
|
||||||
|
# CVE-2023-5367
|
||||||
|
Patch10028: 0001-Xi-randr-fix-handling-of-PropModeAppend-Prepend.patch
|
||||||
|
# CVE-2023-5380
|
||||||
|
Patch10029: 0002-mi-reset-the-PointerWindows-reference-on-screen-swit.patch
|
||||||
|
|
||||||
BuildRequires: make
|
BuildRequires: make
|
||||||
BuildRequires: systemtap-sdt-devel
|
BuildRequires: systemtap-sdt-devel
|
||||||
|
@ -565,6 +570,18 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
|
||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Oct 25 2023 José Expósito <jexposit@redhat.com> - 1.20.11-20
|
||||||
|
- CVE fix for: CVE-2023-5380
|
||||||
|
Resolves: https://issues.redhat.com/browse/RHEL-14062
|
||||||
|
|
||||||
|
* Wed Oct 25 2023 José Expósito <jexposit@redhat.com> - 1.20.11-20
|
||||||
|
- CVE fix for: CVE-2023-5367
|
||||||
|
Resolves: https://issues.redhat.com/browse/RHEL-13430
|
||||||
|
|
||||||
|
* Tue Jun 6 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-19
|
||||||
|
- Backport fix for a deadlock with DRI3
|
||||||
|
Resolves: rhbz#2192550
|
||||||
|
|
||||||
* Fri Mar 31 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-18
|
* Fri Mar 31 2023 Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-18
|
||||||
- CVE fix for: CVE-2023-1393
|
- CVE fix for: CVE-2023-1393
|
||||||
Resolves: rhbz#2180297
|
Resolves: rhbz#2180297
|
||||||
|
|
Loading…
Reference in New Issue