diff options
author | Jackie Huang <jackie.huang@windriver.com> | 2017-08-17 15:39:13 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2017-08-18 23:46:37 +0100 |
commit | 583225d94ae7631f82afd618a00ca0f9ed63fce0 (patch) | |
tree | 0c9023523b5e155fc6ef1bd7b8b4481dc3b7ec82 /meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-3.patch | |
parent | 88a82e74899b4152fcbda9e88aa1e8e77701b5e2 (diff) | |
download | poky-583225d94ae7631f82afd618a00ca0f9ed63fce0.tar.gz |
xserver-xorg: Fix CVE-2017-10971
Backport 3 patches to fix CVE-2017-10971:
In the X.Org X server before 2017-06-19, a user authenticated to an X
Session could crash or execute code in the context of the X Server by
exploiting a stack overflow in the endianness conversion of X Events.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-10971
(From OE-Core rev: 20428f660f2c046c63bbf63c4e4af95dac9f2b3d)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-3.patch')
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-3.patch | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-3.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-3.patch new file mode 100644 index 0000000000..54ba481024 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2017-10971-3.patch | |||
@@ -0,0 +1,50 @@ | |||
1 | From ba336b24052122b136486961c82deac76bbde455 Mon Sep 17 00:00:00 2001 | ||
2 | From: Michal Srb <msrb@suse.com> | ||
3 | Date: Wed, 24 May 2017 15:54:42 +0300 | ||
4 | Subject: [PATCH] Xi: Do not try to swap GenericEvent. | ||
5 | |||
6 | The SProcXSendExtensionEvent must not attempt to swap GenericEvent because | ||
7 | it is assuming that the event has fixed size and gives the swapping function | ||
8 | xEvent-sized buffer. | ||
9 | |||
10 | A GenericEvent would be later rejected by ProcXSendExtensionEvent anyway. | ||
11 | |||
12 | Signed-off-by: Michal Srb <msrb@suse.com> | ||
13 | Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net> | ||
14 | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> | ||
15 | |||
16 | CVE: CVE-2017-10971 | ||
17 | |||
18 | Upstream-Status: Backport [https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455] | ||
19 | |||
20 | Signed-off-by: Jackie Huang <jackie.huang@windriver.com> | ||
21 | --- | ||
22 | Xi/sendexev.c | 10 +++++++++- | ||
23 | 1 file changed, 9 insertions(+), 1 deletion(-) | ||
24 | |||
25 | diff --git a/Xi/sendexev.c b/Xi/sendexev.c | ||
26 | index 5e63bfc..5c2e0fc 100644 | ||
27 | --- a/Xi/sendexev.c | ||
28 | +++ b/Xi/sendexev.c | ||
29 | @@ -95,9 +95,17 @@ SProcXSendExtensionEvent(ClientPtr client) | ||
30 | |||
31 | eventP = (xEvent *) &stuff[1]; | ||
32 | for (i = 0; i < stuff->num_events; i++, eventP++) { | ||
33 | + if (eventP->u.u.type == GenericEvent) { | ||
34 | + client->errorValue = eventP->u.u.type; | ||
35 | + return BadValue; | ||
36 | + } | ||
37 | + | ||
38 | proc = EventSwapVector[eventP->u.u.type & 0177]; | ||
39 | - if (proc == NotImplemented) /* no swapping proc; invalid event type? */ | ||
40 | + /* no swapping proc; invalid event type? */ | ||
41 | + if (proc == NotImplemented) { | ||
42 | + client->errorValue = eventP->u.u.type; | ||
43 | return BadValue; | ||
44 | + } | ||
45 | (*proc) (eventP, &eventT); | ||
46 | *eventP = eventT; | ||
47 | } | ||
48 | -- | ||
49 | 1.7.9.5 | ||
50 | |||