diff options
Diffstat (limited to 'meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch')
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch | 102 |
1 files changed, 102 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch new file mode 100644 index 0000000000..f39f6b32b1 --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-25712.patch | |||
@@ -0,0 +1,102 @@ | |||
1 | From 87c64fc5b0db9f62f4e361444f4b60501ebf67b9 Mon Sep 17 00:00:00 2001 | ||
2 | From: Matthieu Herrb <matthieu@herrb.eu> | ||
3 | Date: Sun, 11 Oct 2020 17:05:09 +0200 | ||
4 | Subject: [PATCH] Fix XkbSetDeviceInfo() and SetDeviceIndicators() heap | ||
5 | overflows | ||
6 | |||
7 | ZDI-CAN 11389 / CVE-2020-25712 | ||
8 | |||
9 | This vulnerability was discovered by: | ||
10 | Jan-Niklas Sohn working with Trend Micro Zero Day Initiative | ||
11 | |||
12 | Signed-off-by: Matthieu Herrb <matthieu@herrb.eu> | ||
13 | |||
14 | Upstream-Status: Backport | ||
15 | https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9 | ||
16 | CVE: CVE-2020-25712 | ||
17 | Signed-off-by: Armin Kuster <akuster@mvista.com> | ||
18 | |||
19 | --- | ||
20 | xkb/xkb.c | 26 +++++++++++++++++++++++--- | ||
21 | 1 file changed, 23 insertions(+), 3 deletions(-) | ||
22 | |||
23 | Index: xorg-server-1.20.8/xkb/xkb.c | ||
24 | =================================================================== | ||
25 | --- xorg-server-1.20.8.orig/xkb/xkb.c | ||
26 | +++ xorg-server-1.20.8/xkb/xkb.c | ||
27 | @@ -6625,7 +6625,9 @@ SetDeviceIndicators(char *wire, | ||
28 | unsigned changed, | ||
29 | int num, | ||
30 | int *status_rtrn, | ||
31 | - ClientPtr client, xkbExtensionDeviceNotify * ev) | ||
32 | + ClientPtr client, | ||
33 | + xkbExtensionDeviceNotify * ev, | ||
34 | + xkbSetDeviceInfoReq * stuff) | ||
35 | { | ||
36 | xkbDeviceLedsWireDesc *ledWire; | ||
37 | int i; | ||
38 | @@ -6646,6 +6648,11 @@ SetDeviceIndicators(char *wire, | ||
39 | xkbIndicatorMapWireDesc *mapWire; | ||
40 | XkbSrvLedInfoPtr sli; | ||
41 | |||
42 | + if (!_XkbCheckRequestBounds(client, stuff, ledWire, ledWire + 1)) { | ||
43 | + *status_rtrn = BadLength; | ||
44 | + return (char *) ledWire; | ||
45 | + } | ||
46 | + | ||
47 | namec = mapc = statec = 0; | ||
48 | sli = XkbFindSrvLedInfo(dev, ledWire->ledClass, ledWire->ledID, | ||
49 | XkbXI_IndicatorMapsMask); | ||
50 | @@ -6664,6 +6671,10 @@ SetDeviceIndicators(char *wire, | ||
51 | memset((char *) sli->names, 0, XkbNumIndicators * sizeof(Atom)); | ||
52 | for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { | ||
53 | if (ledWire->namesPresent & bit) { | ||
54 | + if (!_XkbCheckRequestBounds(client, stuff, atomWire, atomWire + 1)) { | ||
55 | + *status_rtrn = BadLength; | ||
56 | + return (char *) atomWire; | ||
57 | + } | ||
58 | sli->names[n] = (Atom) *atomWire; | ||
59 | if (sli->names[n] == None) | ||
60 | ledWire->namesPresent &= ~bit; | ||
61 | @@ -6681,6 +6692,10 @@ SetDeviceIndicators(char *wire, | ||
62 | if (ledWire->mapsPresent) { | ||
63 | for (n = 0, bit = 1; n < XkbNumIndicators; n++, bit <<= 1) { | ||
64 | if (ledWire->mapsPresent & bit) { | ||
65 | + if (!_XkbCheckRequestBounds(client, stuff, mapWire, mapWire + 1)) { | ||
66 | + *status_rtrn = BadLength; | ||
67 | + return (char *) mapWire; | ||
68 | + } | ||
69 | sli->maps[n].flags = mapWire->flags; | ||
70 | sli->maps[n].which_groups = mapWire->whichGroups; | ||
71 | sli->maps[n].groups = mapWire->groups; | ||
72 | @@ -6760,7 +6775,7 @@ _XkbSetDeviceInfoCheck(ClientPtr client, | ||
73 | ed.deviceID = dev->id; | ||
74 | wire = (char *) &stuff[1]; | ||
75 | if (stuff->change & XkbXI_ButtonActionsMask) { | ||
76 | - int nBtns, sz, i; | ||
77 | + int nBtns, sz, i; | ||
78 | XkbAction *acts; | ||
79 | DeviceIntPtr kbd; | ||
80 | |||
81 | @@ -6772,7 +6787,11 @@ _XkbSetDeviceInfoCheck(ClientPtr client, | ||
82 | return BadAlloc; | ||
83 | dev->button->xkb_acts = acts; | ||
84 | } | ||
85 | + if (stuff->firstBtn + stuff->nBtns > nBtns) | ||
86 | + return BadValue; | ||
87 | sz = stuff->nBtns * SIZEOF(xkbActionWireDesc); | ||
88 | + if (!_XkbCheckRequestBounds(client, stuff, wire, (char *) wire + sz)) | ||
89 | + return BadLength; | ||
90 | memcpy((char *) &acts[stuff->firstBtn], (char *) wire, sz); | ||
91 | wire += sz; | ||
92 | ed.reason |= XkbXI_ButtonActionsMask; | ||
93 | @@ -6793,7 +6812,8 @@ _XkbSetDeviceInfoCheck(ClientPtr client, | ||
94 | int status = Success; | ||
95 | |||
96 | wire = SetDeviceIndicators(wire, dev, stuff->change, | ||
97 | - stuff->nDeviceLedFBs, &status, client, &ed); | ||
98 | + stuff->nDeviceLedFBs, &status, client, &ed, | ||
99 | + stuff); | ||
100 | if (status != Success) | ||
101 | return status; | ||
102 | } | ||