diff options
author | Kai Kang <kai.kang@windriver.com> | 2021-12-28 17:29:14 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-01-07 23:21:34 +0000 |
commit | c7cd0868ce7e19e318c4aa061e318dbeeae1e2d9 (patch) | |
tree | 1a6e2990abbcb037d73f43a1cd1eb6a52b56a78b | |
parent | b6e3bbc1deaaa75ee26a8ef0f23eb0b3203c56e0 (diff) | |
download | poky-c7cd0868ce7e19e318c4aa061e318dbeeae1e2d9.tar.gz |
xserver-xorg: fix CVE-2021-4011
Backport patch to fix CVE-2021-4011 for xserver-xorg.
CVE: CVE-2021-4011
(From OE-Core rev: 5f300f2be6453947a37231ced56ca577c91d93b4)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch | 40 | ||||
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb | 1 |
2 files changed, 41 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch new file mode 100644 index 0000000000..c7eb03091d --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2021-4011.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | Backport patch to fix CVE-2021-4011. | ||
2 | |||
3 | CVE: CVE-2021-4011 | ||
4 | Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/e56f61c] | ||
5 | |||
6 | Signed-off-by: Kai Kang <kai.kang@windriver.com> | ||
7 | |||
8 | From e56f61c79fc3cee26d83cda0f84ae56d5979f768 Mon Sep 17 00:00:00 2001 | ||
9 | From: Povilas Kanapickas <povilas@radix.lt> | ||
10 | Date: Tue, 14 Dec 2021 15:00:00 +0200 | ||
11 | Subject: [PATCH] record: Fix out of bounds access in SwapCreateRegister() | ||
12 | |||
13 | ZDI-CAN-14952, CVE-2021-4011 | ||
14 | |||
15 | This vulnerability was discovered and the fix was suggested by: | ||
16 | Jan-Niklas Sohn working with Trend Micro Zero Day Initiative | ||
17 | |||
18 | Signed-off-by: Povilas Kanapickas <povilas@radix.lt> | ||
19 | --- | ||
20 | record/record.c | 4 ++-- | ||
21 | 1 file changed, 2 insertions(+), 2 deletions(-) | ||
22 | |||
23 | diff --git a/record/record.c b/record/record.c | ||
24 | index be154525d..e123867a7 100644 | ||
25 | --- a/record/record.c | ||
26 | +++ b/record/record.c | ||
27 | @@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff) | ||
28 | swapl(pClientID); | ||
29 | } | ||
30 | if (stuff->nRanges > | ||
31 | - client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq) | ||
32 | - - stuff->nClients) | ||
33 | + (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq) | ||
34 | + - stuff->nClients) / bytes_to_int32(sz_xRecordRange)) | ||
35 | return BadLength; | ||
36 | RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges); | ||
37 | return Success; | ||
38 | -- | ||
39 | GitLab | ||
40 | |||
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb index 84b0acb42f..58f1eb328e 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.10.bb | |||
@@ -12,6 +12,7 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat | |||
12 | file://CVE-2021-4008.patch \ | 12 | file://CVE-2021-4008.patch \ |
13 | file://CVE-2021-4009.patch \ | 13 | file://CVE-2021-4009.patch \ |
14 | file://CVE-2021-4010.patch \ | 14 | file://CVE-2021-4010.patch \ |
15 | file://CVE-2021-4011.patch \ | ||
15 | " | 16 | " |
16 | SRC_URI[sha256sum] = "977420c082450dc808de301ef56af4856d653eea71519a973c3490a780cb7c99" | 17 | SRC_URI[sha256sum] = "977420c082450dc808de301ef56af4856d653eea71519a973c3490a780cb7c99" |
17 | 18 | ||