diff options
author | Ross Burton <ross.burton@arm.com> | 2022-10-24 16:07:45 +0100 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-12-13 15:23:34 +0000 |
commit | 39c76401c01659b486056b9458462a79d96b524a (patch) | |
tree | a789471839a4a612521a6458abdabdd829756eef /meta/recipes-graphics | |
parent | ca83262bdd89e1104ec3cc713a5f734961256aa7 (diff) | |
download | poky-39c76401c01659b486056b9458462a79d96b524a.tar.gz |
xserver-xorg: backport fixes for CVE-2022-3550 and CVE-2022-3551
(From OE-Core rev: e40a8d939535bbb2f89aabd48c1cf843be5bb564)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit e32401d8bf44afcca88af7e4c5948d2c28e1813f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-graphics')
3 files changed, 103 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch new file mode 100644 index 0000000000..0e61ec5953 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch | |||
@@ -0,0 +1,63 @@ | |||
1 | CVE: CVE-2022-3551 | ||
2 | Upstream-Status: Backport | ||
3 | Signed-off-by: Ross Burton <ross.burton@arm.com> | ||
4 | |||
5 | From 18f91b950e22c2a342a4fbc55e9ddf7534a707d2 Mon Sep 17 00:00:00 2001 | ||
6 | From: Peter Hutterer <peter.hutterer@who-t.net> | ||
7 | Date: Wed, 13 Jul 2022 11:23:09 +1000 | ||
8 | Subject: [PATCH] xkb: fix some possible memleaks in XkbGetKbdByName | ||
9 | |||
10 | GetComponentByName returns an allocated string, so let's free that if we | ||
11 | fail somewhere. | ||
12 | |||
13 | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> | ||
14 | --- | ||
15 | xkb/xkb.c | 26 ++++++++++++++++++++------ | ||
16 | 1 file changed, 20 insertions(+), 6 deletions(-) | ||
17 | |||
18 | diff --git a/xkb/xkb.c b/xkb/xkb.c | ||
19 | index 4692895db..b79a269e3 100644 | ||
20 | --- a/xkb/xkb.c | ||
21 | +++ b/xkb/xkb.c | ||
22 | @@ -5935,18 +5935,32 @@ ProcXkbGetKbdByName(ClientPtr client) | ||
23 | xkb = dev->key->xkbInfo->desc; | ||
24 | status = Success; | ||
25 | str = (unsigned char *) &stuff[1]; | ||
26 | - if (GetComponentSpec(&str, TRUE, &status)) /* keymap, unsupported */ | ||
27 | - return BadMatch; | ||
28 | + { | ||
29 | + char *keymap = GetComponentSpec(&str, TRUE, &status); /* keymap, unsupported */ | ||
30 | + if (keymap) { | ||
31 | + free(keymap); | ||
32 | + return BadMatch; | ||
33 | + } | ||
34 | + } | ||
35 | names.keycodes = GetComponentSpec(&str, TRUE, &status); | ||
36 | names.types = GetComponentSpec(&str, TRUE, &status); | ||
37 | names.compat = GetComponentSpec(&str, TRUE, &status); | ||
38 | names.symbols = GetComponentSpec(&str, TRUE, &status); | ||
39 | names.geometry = GetComponentSpec(&str, TRUE, &status); | ||
40 | - if (status != Success) | ||
41 | + if (status == Success) { | ||
42 | + len = str - ((unsigned char *) stuff); | ||
43 | + if ((XkbPaddedSize(len) / 4) != stuff->length) | ||
44 | + status = BadLength; | ||
45 | + } | ||
46 | + | ||
47 | + if (status != Success) { | ||
48 | + free(names.keycodes); | ||
49 | + free(names.types); | ||
50 | + free(names.compat); | ||
51 | + free(names.symbols); | ||
52 | + free(names.geometry); | ||
53 | return status; | ||
54 | - len = str - ((unsigned char *) stuff); | ||
55 | - if ((XkbPaddedSize(len) / 4) != stuff->length) | ||
56 | - return BadLength; | ||
57 | + } | ||
58 | |||
59 | CHK_MASK_LEGAL(0x01, stuff->want, XkbGBN_AllComponentsMask); | ||
60 | CHK_MASK_LEGAL(0x02, stuff->need, XkbGBN_AllComponentsMask); | ||
61 | -- | ||
62 | 2.34.1 | ||
63 | |||
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xkb-proof-GetCountedString-against-request-length-at.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xkb-proof-GetCountedString-against-request-length-at.patch new file mode 100644 index 0000000000..6f862e82f9 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-xkb-proof-GetCountedString-against-request-length-at.patch | |||
@@ -0,0 +1,38 @@ | |||
1 | CVE: CVE-2022-3550 | ||
2 | Upstream-Status: Backport | ||
3 | Signed-off-by: Ross Burton <ross.burton@arm.com> | ||
4 | |||
5 | From 11beef0b7f1ed290348e45618e5fa0d2bffcb72e Mon Sep 17 00:00:00 2001 | ||
6 | From: Peter Hutterer <peter.hutterer@who-t.net> | ||
7 | Date: Tue, 5 Jul 2022 12:06:20 +1000 | ||
8 | Subject: [PATCH] xkb: proof GetCountedString against request length attacks | ||
9 | |||
10 | GetCountedString did a check for the whole string to be within the | ||
11 | request buffer but not for the initial 2 bytes that contain the length | ||
12 | field. A swapped client could send a malformed request to trigger a | ||
13 | swaps() on those bytes, writing into random memory. | ||
14 | |||
15 | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> | ||
16 | --- | ||
17 | xkb/xkb.c | 5 +++++ | ||
18 | 1 file changed, 5 insertions(+) | ||
19 | |||
20 | diff --git a/xkb/xkb.c b/xkb/xkb.c | ||
21 | index f42f59ef3..1841cff26 100644 | ||
22 | --- a/xkb/xkb.c | ||
23 | +++ b/xkb/xkb.c | ||
24 | @@ -5137,6 +5137,11 @@ _GetCountedString(char **wire_inout, ClientPtr client, char **str) | ||
25 | CARD16 len; | ||
26 | |||
27 | wire = *wire_inout; | ||
28 | + | ||
29 | + if (client->req_len < | ||
30 | + bytes_to_int32(wire + 2 - (char *) client->requestBuffer)) | ||
31 | + return BadValue; | ||
32 | + | ||
33 | len = *(CARD16 *) wire; | ||
34 | if (client->swapped) { | ||
35 | swaps(&len); | ||
36 | -- | ||
37 | 2.34.1 | ||
38 | |||
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.4.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.4.bb index b9cbc9989e..aba09afec3 100644 --- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.4.bb +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.4.bb | |||
@@ -2,6 +2,8 @@ require xserver-xorg.inc | |||
2 | 2 | ||
3 | SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \ | 3 | SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.patch \ |
4 | file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \ | 4 | file://0001-Avoid-duplicate-definitions-of-IOPortBase.patch \ |
5 | file://0001-xkb-fix-some-possible-memleaks-in-XkbGetKbdByName.patch \ | ||
6 | file://0001-xkb-proof-GetCountedString-against-request-length-at.patch \ | ||
5 | " | 7 | " |
6 | SRC_URI[sha256sum] = "5cc4be8ee47edb58d4a90e603a59d56b40291ad38371b0bd2471fc3cbee1c587" | 8 | SRC_URI[sha256sum] = "5cc4be8ee47edb58d4a90e603a59d56b40291ad38371b0bd2471fc3cbee1c587" |
7 | 9 | ||