From 42ec29c7fbf8dc797c369d5fe0e4f2e20725332b Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Wed, 27 Nov 2024 11:27:05 +0100 Subject: [PATCH xserver 01/13] Cursor: Refuse to free the root cursor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If a cursor reference count drops to 0, the cursor is freed. The root cursor however is referenced with a specific global variable, and when the root cursor is freed, the global variable may still point to freed memory. Make sure to prevent the rootCursor from being explicitly freed by a client. CVE-2025-26594, ZDI-CAN-25544 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative v2: Explicitly forbid XFreeCursor() on the root cursor (Peter Hutterer ) v3: Return BadCursor instead of BadValue (Michel Dänzer ) Signed-off-by: Olivier Fourdan Suggested-by: Peter Hutterer Reviewed-by: Peter Hutterer (cherry picked from commit 01642f263f12becf803b19be4db95a4a83f94acc) Part-of: --- dix/dispatch.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dix/dispatch.c b/dix/dispatch.c index a33bfaa9e..9654c207e 100644 --- a/dix/dispatch.c +++ b/dix/dispatch.c @@ -3039,6 +3039,10 @@ ProcFreeCursor(ClientPtr client) rc = dixLookupResourceByType((void **) &pCursor, stuff->id, RT_CURSOR, client, DixDestroyAccess); if (rc == Success) { + if (pCursor == rootCursor) { + client->errorValue = stuff->id; + return BadCursor; + } FreeResource(stuff->id, RT_NONE); return Success; } -- 2.48.1