diff options
Diffstat (limited to 'meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch')
-rw-r--r-- | meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch | 84 |
1 files changed, 84 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch new file mode 100644 index 0000000000..508588481e --- /dev/null +++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-5367.patch | |||
@@ -0,0 +1,84 @@ | |||
1 | From 541ab2ecd41d4d8689e71855d93e492bc554719a Mon Sep 17 00:00:00 2001 | ||
2 | From: Peter Hutterer <peter.hutterer@who-t.net> | ||
3 | Date: Tue, 3 Oct 2023 11:53:05 +1000 | ||
4 | Subject: [PATCH] Xi/randr: fix handling of PropModeAppend/Prepend | ||
5 | |||
6 | The handling of appending/prepending properties was incorrect, with at | ||
7 | least two bugs: the property length was set to the length of the new | ||
8 | part only, i.e. appending or prepending N elements to a property with P | ||
9 | existing elements always resulted in the property having N elements | ||
10 | instead of N + P. | ||
11 | |||
12 | Second, when pre-pending a value to a property, the offset for the old | ||
13 | values was incorrect, leaving the new property with potentially | ||
14 | uninitalized values and/or resulting in OOB memory writes. | ||
15 | For example, prepending a 3 element value to a 5 element property would | ||
16 | result in this 8 value array: | ||
17 | [N, N, N, ?, ?, P, P, P ] P, P | ||
18 | ^OOB write | ||
19 | |||
20 | The XI2 code is a copy/paste of the RandR code, so the bug exists in | ||
21 | both. | ||
22 | |||
23 | CVE-2023-5367, ZDI-CAN-22153 | ||
24 | |||
25 | This vulnerability was discovered by: | ||
26 | Jan-Niklas Sohn working with Trend Micro Zero Day Initiative | ||
27 | |||
28 | Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net> | ||
29 | |||
30 | Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/541ab2ecd41d4d8689e71855d93e492bc554719a] | ||
31 | CVE: CVE-2023-5367 | ||
32 | Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> | ||
33 | --- | ||
34 | Xi/xiproperty.c | 4 ++-- | ||
35 | randr/rrproperty.c | 4 ++-- | ||
36 | 2 files changed, 4 insertions(+), 4 deletions(-) | ||
37 | |||
38 | diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c | ||
39 | index 066ba21fba..d315f04d0e 100644 | ||
40 | --- a/Xi/xiproperty.c | ||
41 | +++ b/Xi/xiproperty.c | ||
42 | @@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, | ||
43 | XIDestroyDeviceProperty(prop); | ||
44 | return BadAlloc; | ||
45 | } | ||
46 | - new_value.size = len; | ||
47 | + new_value.size = total_len; | ||
48 | new_value.type = type; | ||
49 | new_value.format = format; | ||
50 | |||
51 | @@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type, | ||
52 | case PropModePrepend: | ||
53 | new_data = new_value.data; | ||
54 | old_data = (void *) (((char *) new_value.data) + | ||
55 | - (prop_value->size * size_in_bytes)); | ||
56 | + (len * size_in_bytes)); | ||
57 | break; | ||
58 | } | ||
59 | if (new_data) | ||
60 | diff --git a/randr/rrproperty.c b/randr/rrproperty.c | ||
61 | index c2fb9585c6..25469f57b2 100644 | ||
62 | --- a/randr/rrproperty.c | ||
63 | +++ b/randr/rrproperty.c | ||
64 | @@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, | ||
65 | RRDestroyOutputProperty(prop); | ||
66 | return BadAlloc; | ||
67 | } | ||
68 | - new_value.size = len; | ||
69 | + new_value.size = total_len; | ||
70 | new_value.type = type; | ||
71 | new_value.format = format; | ||
72 | |||
73 | @@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type, | ||
74 | case PropModePrepend: | ||
75 | new_data = new_value.data; | ||
76 | old_data = (void *) (((char *) new_value.data) + | ||
77 | - (prop_value->size * size_in_bytes)); | ||
78 | + (len * size_in_bytes)); | ||
79 | break; | ||
80 | } | ||
81 | if (new_data) | ||
82 | -- | ||
83 | GitLab | ||
84 | |||