2015d83dd5
Add upstream patches fixing the following security issues: CVE-2017-10971: The endianess handling for X Events assumed a fixed size of X Event structures and had a specific 32 byte stack buffer for that. However "GenericEvents" can have any size, so if the events were sent in the wrong endianess, this stack buffer could be overflowed easily. So authenticated X users could overflow the stack in the X Server and with the X server usually running as root gaining root prileveges. CVE-2017-10972: An information leak out of the X server due to an uninitialized stack area when swapping event endianess. For more details, see the advisory: http://www.openwall.com/lists/oss-security/2017/07/06/6 Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
46 lines
1.5 KiB
Diff
46 lines
1.5 KiB
Diff
From ba336b24052122b136486961c82deac76bbde455 Mon Sep 17 00:00:00 2001
|
|
From: Michal Srb <msrb@suse.com>
|
|
Date: Wed, 24 May 2017 15:54:42 +0300
|
|
Subject: [PATCH] Xi: Do not try to swap GenericEvent.
|
|
|
|
The SProcXSendExtensionEvent must not attempt to swap GenericEvent because
|
|
it is assuming that the event has fixed size and gives the swapping function
|
|
xEvent-sized buffer.
|
|
|
|
A GenericEvent would be later rejected by ProcXSendExtensionEvent anyway.
|
|
|
|
Signed-off-by: Michal Srb <msrb@suse.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
---
|
|
Xi/sendexev.c | 10 +++++++++-
|
|
1 file changed, 9 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
|
|
index 5e63bfcca..5c2e0fc56 100644
|
|
--- a/Xi/sendexev.c
|
|
+++ b/Xi/sendexev.c
|
|
@@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client)
|
|
|
|
eventP = (xEvent *) &stuff[1];
|
|
for (i = 0; i < stuff->num_events; i++, eventP++) {
|
|
+ if (eventP->u.u.type == GenericEvent) {
|
|
+ client->errorValue = eventP->u.u.type;
|
|
+ return BadValue;
|
|
+ }
|
|
+
|
|
proc = EventSwapVector[eventP->u.u.type & 0177];
|
|
- if (proc == NotImplemented) /* no swapping proc; invalid event type? */
|
|
+ /* no swapping proc; invalid event type? */
|
|
+ if (proc == NotImplemented) {
|
|
+ client->errorValue = eventP->u.u.type;
|
|
return BadValue;
|
|
+ }
|
|
(*proc) (eventP, &eventT);
|
|
*eventP = eventT;
|
|
}
|
|
--
|
|
2.11.0
|
|
|