packages/xorg-x11-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix CVE-2024-9632

Browse Source 
(cherry picked from commit 0aad729b68578c67031d4fb41be57887dc13cd16)
This commit is contained in:
wk333 2024-11-04 14:53:53 +08:00 committed by openeuler-sync-bot
parent 12ce14d5f9
commit dd974ad9ad
2 changed files with 62 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
backport-CVE-2024-9632.patch Normal file
View File

@ -0,0 +1,57 @@
From 85b776571487f52e756f68a069c768757369bfe3 Mon Sep 17 00:00:00 2001
From: Matthieu Herrb <matthieu@herrb.eu>
Date: Thu, 10 Oct 2024 10:37:28 +0200
Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
origin: https://gitlab.freedesktop.org/xorg/xserver/-/commit/85b776571487f52e756f68a069c768757369bfe3
The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.
However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.
This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).
CVE-2024-9632, ZDI-CAN-24756
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1733>
---
xkb/xkb.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/xkb/xkb.c b/xkb/xkb.c
index 868d7c1e64..aaf9716b36 100644
--- a/xkb/xkb.c
+++ b/xkb/xkb.c
@@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
XkbSymInterpretPtr sym;
unsigned int skipped = 0;
- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
- compat->num_si = req->firstSI + req->nSI;
+ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
+ compat->num_si = compat->size_si = req->firstSI + req->nSI;
compat->sym_interpret = reallocarray(compat->sym_interpret,
- compat->num_si,
+ compat->size_si,
sizeof(XkbSymInterpretRec));
if (!compat->sym_interpret) {
- compat->num_si = 0;
+ compat->num_si = compat->size_si = 0;
return BadAlloc;
}
}
--
GitLab

6
xorg-x11-server.spec
View File

@ -16,7 +16,7 @@
Name: xorg-x11-server
Version: 1.20.11
Release: 33
Release: 34
Summary: X.Org X11 X server
License: MIT and GPLv2
URL: https://www.x.org
@ -130,6 +130,7 @@ Patch6043: backport-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch
Patch6044: backport-0001-CVE-2023-5574.patch
Patch6045: backport-0002-CVE-2023-5574.patch
Patch6046: backport-0003-CVE-2023-5574.patch
Patch6047: backport-CVE-2024-9632.patch
BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc
BuildRequires: systemtap-sdt-devel libtool pkgconfig
@ -471,6 +472,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete
%{_mandir}/man*/*
%changelog
* Mon Nov 04 2024 wangkai <13474090681@163.com> - 1.20.11-34
- Fix CVE-2024-9632
* Thu Oct 24 2024 lingsheng <lingsheng1@h-partners.com> - 1.20.11-33
- Type:CVE
- CVE:CVE-2023-5574