diff options
author | Ashish Sharma <asharma@mvista.com> | 2024-04-07 00:13:53 +0530 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2024-04-13 04:51:47 -0700 |
commit | 42694d5ea21588ecb289ed5106656e839ae326ff (patch) | |
tree | 3ad702fdb997e6599688b1f0186add645cbbad93 | |
parent | 2e04c8f59a1fba0f07e09f6764d0d6b1d0114ea2 (diff) | |
download | poky-42694d5ea21588ecb289ed5106656e839ae326ff.tar.gz |
xserver-xorg: Backport fix for CVE-2024-31081
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/3e77295f888c67fc7645db5d0c00926a29ffecee]
(From OE-Core rev: bfda6a90f99f3051172e28c4a6c049d745ed5cb8)
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch | 47 | ||||
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb | 1 |
2 files changed, 48 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch new file mode 100644 index 0000000000..d2c551a0e5 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch | |||
@@ -0,0 +1,47 @@ | |||
1 | From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001 | ||
2 | From: Alan Coopersmith <alan.coopersmith@oracle.com> | ||
3 | Date: Fri, 22 Mar 2024 18:56:27 -0700 | ||
4 | Subject: [PATCH] Xi: ProcXIPassiveGrabDevice needs to use unswapped length to | ||
5 | send reply | ||
6 | |||
7 | CVE-2024-31081 | ||
8 | |||
9 | Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.") | ||
10 | Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com> | ||
11 | Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463> | ||
12 | |||
13 | Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/3e77295f888c67fc7645db5d0c00926a29ffecee] | ||
14 | CVE: CVE-2024-31081 | ||
15 | Signed-off-by: Ashish Sharma <asharma@mvista.com> | ||
16 | |||
17 | Xi/xipassivegrab.c | 5 ++++- | ||
18 | 1 file changed, 4 insertions(+), 1 deletion(-) | ||
19 | |||
20 | diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c | ||
21 | index c9ac2f8553..896233bec2 100644 | ||
22 | --- a/Xi/xipassivegrab.c | ||
23 | +++ b/Xi/xipassivegrab.c | ||
24 | @@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client) | ||
25 | GrabParameters param; | ||
26 | void *tmp; | ||
27 | int mask_len; | ||
28 | + uint32_t length; | ||
29 | |||
30 | REQUEST(xXIPassiveGrabDeviceReq); | ||
31 | REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq, | ||
32 | @@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client) | ||
33 | } | ||
34 | } | ||
35 | |||
36 | + /* save the value before SRepXIPassiveGrabDevice swaps it */ | ||
37 | + length = rep.length; | ||
38 | WriteReplyToClient(client, sizeof(rep), &rep); | ||
39 | if (rep.num_modifiers) | ||
40 | - WriteToClient(client, rep.length * 4, modifiers_failed); | ||
41 | + WriteToClient(client, length * 4, modifiers_failed); | ||
42 | |||
43 | out: | ||
44 | free(modifiers_failed); | ||
45 | -- | ||
46 | GitLab | ||
47 | |||
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb index d6c6c5bd45..ade250542f 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.14.bb | |||
@@ -30,6 +30,7 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat | |||
30 | file://CVE-2024-21886-2.patch \ | 30 | file://CVE-2024-21886-2.patch \ |
31 | file://CVE-2024-0408.patch \ | 31 | file://CVE-2024-0408.patch \ |
32 | file://CVE-2024-0409.patch \ | 32 | file://CVE-2024-0409.patch \ |
33 | file://CVE-2024-31081.patch \ | ||
33 | " | 34 | " |
34 | SRC_URI[md5sum] = "453fc86aac8c629b3a5b77e8dcca30bf" | 35 | SRC_URI[md5sum] = "453fc86aac8c629b3a5b77e8dcca30bf" |
35 | SRC_URI[sha256sum] = "54b199c9280ff8bf0f73a54a759645bd0eeeda7255d1c99310d5b7595f3ac066" | 36 | SRC_URI[sha256sum] = "54b199c9280ff8bf0f73a54a759645bd0eeeda7255d1c99310d5b7595f3ac066" |