From 004f461c440cb6611eefb48fbbb4fa53a6d49f80 Mon Sep 17 00:00:00 2001 From: Peter Hutterer Date: Thu, 5 Oct 2023 12:19:45 +1000 Subject: [PATCH xserver 2/4] mi: reset the PointerWindows reference on screen switch PointerWindows[] keeps a reference to the last window our sprite entered - changes are usually handled by CheckMotion(). If we switch between screens via XWarpPointer our dev->spriteInfo->sprite->win is set to the new screen's root window. If there's another window at the cursor location CheckMotion() will trigger the right enter/leave events later. If there is not, it skips that process and we never trigger LeaveWindow() - PointerWindows[] for the device still refers to the previous window. If that window is destroyed we have a dangling reference that will eventually cause a use-after-free bug when checking the window hierarchy later. To trigger this, we require: - two protocol screens - XWarpPointer to the other screen's root window - XDestroyWindow before entering any other window This is a niche bug so we hack around it by making sure we reset the PointerWindows[] entry so we cannot have a dangling pointer. This doesn't handle Enter/Leave events correctly but the previous code didn't either. CVE-2023-5380, ZDI-CAN-21608 This vulnerability was discovered by: Sri working with Trend Micro Zero Day Initiative Signed-off-by: Peter Hutterer Reviewed-by: Adam Jackson --- dix/enterleave.h | 2 -- include/eventstr.h | 3 +++ mi/mipointer.c | 17 +++++++++++++++-- 3 files changed, 18 insertions(+), 4 deletions(-) diff --git a/dix/enterleave.h b/dix/enterleave.h index 4b833d8a3b..e8af924c68 100644 --- a/dix/enterleave.h +++ b/dix/enterleave.h @@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev, extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode); -extern void LeaveWindow(DeviceIntPtr dev); - extern void CoreFocusEvent(DeviceIntPtr kbd, int type, int mode, int detail, WindowPtr pWin); diff --git a/include/eventstr.h b/include/eventstr.h index bf3b95fe4a..2bae3b0767 100644 --- a/include/eventstr.h +++ b/include/eventstr.h @@ -296,4 +296,7 @@ union _InternalEvent { #endif }; +extern void +LeaveWindow(DeviceIntPtr dev); + #endif diff --git a/mi/mipointer.c b/mi/mipointer.c index 75be1aeeb8..b12ae9be1d 100644 --- a/mi/mipointer.c +++ b/mi/mipointer.c @@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y) #ifdef PANORAMIX && noPanoramiXExtension #endif - ) - UpdateSpriteForScreen(pDev, pScreen); + ) { + DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER); + /* Hack for CVE-2023-5380: if we're moving + * screens PointerWindows[] keeps referring to the + * old window. If that gets destroyed we have a UAF + * bug later. Only happens when jumping from a window + * to the root window on the other screen. + * Enter/Leave events are incorrect for that case but + * too niche to fix. + */ + LeaveWindow(pDev); + if (master) + LeaveWindow(master); + UpdateSpriteForScreen(pDev, pScreen); + } } /** -- 2.41.0