summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSiddharth Doshi <sdoshi@mvista.com>2023-10-20 13:40:08 +0530
committerSteve Sakoman <steve@sakoman.com>2023-10-25 04:45:50 -1000
commitfb38c596330fc4cc878282a54a472cf6e485a45f (patch)
tree71068e9eb9e5aa2ad7a16356685474779783075c
parent386672ff8c0cd525b97be1ceb5390e51b97fcd9a (diff)
downloadpoky-fb38c596330fc4cc878282a54a472cf6e485a45f.tar.gz
libx11: Security Fix for CVE-2023-43785, CVE-2023-43786 and CVE-2023-43787
CVE's Fixed: CVE-2023-43785: libX11: out-of-bounds memory access in _XkbReadKeySyms() CVE-2023-43786: libX11: stack exhaustion from infinite recursion in PutSubImage() CVE-2023-43787: libX11: integer overflow in XCreateImage() leading to a heap overflow (From OE-Core rev: 8175d023c203d524d011d8947f90fbd02786c6db) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch62
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch41
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch45
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch51
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch63
-rw-r--r--meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb5
6 files changed, 267 insertions, 0 deletions
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch
new file mode 100644
index 0000000000..64f8776cc9
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch
@@ -0,0 +1,62 @@
1From 6858d468d9ca55fb4c5fd70b223dbc78a3358a7f Mon Sep 17 00:00:00 2001
2From: Alan Coopersmith <alan.coopersmith@oracle.com>
3Date: Sun, 17 Sep 2023 14:19:40 -0700
4Subject: [PATCH] CVE-2023-43785: out-of-bounds memory access in
5 _XkbReadKeySyms()
6
7Make sure we allocate enough memory in the first place, and
8also handle error returns from _XkbReadBufferCopyKeySyms() when
9it detects out-of-bounds issues.
10
11Reported-by: Gregory James DUCK <gjduck@gmail.com>
12Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
13
14Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6858d468d9ca55fb4c5fd70b223dbc78a3358a7f]
15CVE: CVE-2023-43785
16Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
17---
18 src/xkb/XKBGetMap.c | 14 +++++++++-----
19 1 file changed, 9 insertions(+), 5 deletions(-)
20
21diff --git a/src/xkb/XKBGetMap.c b/src/xkb/XKBGetMap.c
22index 2891d21..31199e4 100644
23--- a/src/xkb/XKBGetMap.c
24+++ b/src/xkb/XKBGetMap.c
25@@ -182,7 +182,8 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
26 if (offset + newMap->nSyms >= map->size_syms) {
27 register int sz;
28
29- sz = map->size_syms + 128;
30+ sz = offset + newMap->nSyms;
31+ sz = ((sz + (unsigned) 128) / 128) * 128;
32 _XkbResizeArray(map->syms, map->size_syms, sz, KeySym);
33 if (map->syms == NULL) {
34 map->size_syms = 0;
35@@ -191,8 +192,9 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
36 map->size_syms = sz;
37 }
38 if (newMap->nSyms > 0) {
39- _XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
40- newMap->nSyms);
41+ if (_XkbReadBufferCopyKeySyms(buf, (KeySym *) &map->syms[offset],
42+ newMap->nSyms) == 0)
43+ return BadLength;
44 offset += newMap->nSyms;
45 }
46 else {
47@@ -222,8 +224,10 @@ _XkbReadKeySyms(XkbReadBufferPtr buf, XkbDescPtr xkb, xkbGetMapReply *rep)
48 newSyms = XkbResizeKeySyms(xkb, i + rep->firstKeySym, tmp);
49 if (newSyms == NULL)
50 return BadAlloc;
51- if (newMap->nSyms > 0)
52- _XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms);
53+ if (newMap->nSyms > 0) {
54+ if (_XkbReadBufferCopyKeySyms(buf, newSyms, newMap->nSyms) == 0)
55+ return BadLength;
56+ }
57 else
58 newSyms[0] = NoSymbol;
59 oldMap->kt_index[0] = newMap->ktIndex[0];
60--
612.35.7
62
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch
new file mode 100644
index 0000000000..db5b7067aa
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch
@@ -0,0 +1,41 @@
1From 204c3393c4c90a29ed6bef64e43849536e863a86 Mon Sep 17 00:00:00 2001
2From: Alan Coopersmith <alan.coopersmith@oracle.com>
3Date: Thu, 7 Sep 2023 15:54:30 -0700
4Subject: [PATCH] CVE-2023-43786: stack exhaustion from infinite recursion in
5 PutSubImage()
6
7When splitting a single line of pixels into chunks to send to the
8X server, be sure to take into account the number of bits per pixel,
9so we don't just loop forever trying to send more pixels than fit in
10the given request size and not breaking them down into a small enough
11chunk to fix.
12
13Fixes: "almost complete rewrite" (Dec. 12, 1987) from X11R2
14Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
15
16Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/204c3393c4c90a29ed6bef64e43849536e863a86]
17CVE: CVE-2023-43786
18Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
19---
20 src/PutImage.c | 5 +++--
21 1 file changed, 3 insertions(+), 2 deletions(-)
22
23diff --git a/src/PutImage.c b/src/PutImage.c
24index 857ee91..a6db7b4 100644
25--- a/src/PutImage.c
26+++ b/src/PutImage.c
27@@ -914,8 +914,9 @@ PutSubImage (
28 req_width, req_height - SubImageHeight,
29 dest_bits_per_pixel, dest_scanline_pad);
30 } else {
31- int SubImageWidth = (((Available << 3) / dest_scanline_pad)
32- * dest_scanline_pad) - left_pad;
33+ int SubImageWidth = ((((Available << 3) / dest_scanline_pad)
34+ * dest_scanline_pad) - left_pad)
35+ / dest_bits_per_pixel;
36
37 PutSubImage(dpy, d, gc, image, req_xoffset, req_yoffset, x, y,
38 (unsigned int) SubImageWidth, 1,
39--
402.35.7
41
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch
new file mode 100644
index 0000000000..e46b3a2b24
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch
@@ -0,0 +1,45 @@
1From 73a37d5f2fcadd6540159b432a70d80f442ddf4a Mon Sep 17 00:00:00 2001
2From: Alan Coopersmith <alan.coopersmith@oracle.com>
3Date: Thu, 7 Sep 2023 15:55:04 -0700
4Subject: [PATCH] XPutImage: clip images to maximum height & width allowed by
5 protocol
6
7The PutImage request specifies height & width of the image as CARD16
8(unsigned 16-bit integer), same as the maximum dimensions of an X11
9Drawable, which the image is being copied to.
10
11Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
12
13Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/73a37d5f2fcadd6540159b432a70d80f442ddf4a]
14CVE: CVE-2023-43786
15Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
16---
17 src/PutImage.c | 5 +++++
18 1 file changed, 5 insertions(+)
19
20diff --git a/src/PutImage.c b/src/PutImage.c
21index a6db7b4..ba411e3 100644
22--- a/src/PutImage.c
23+++ b/src/PutImage.c
24@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
25 #include "Xlibint.h"
26 #include "Xutil.h"
27 #include <stdio.h>
28+#include <limits.h>
29 #include "Cr.h"
30 #include "ImUtil.h"
31 #include "reallocarray.h"
32@@ -962,6 +963,10 @@ XPutImage (
33 height = image->height - req_yoffset;
34 if ((width <= 0) || (height <= 0))
35 return 0;
36+ if (width > USHRT_MAX)
37+ width = USHRT_MAX;
38+ if (height > USHRT_MAX)
39+ height = USHRT_MAX;
40
41 if ((image->bits_per_pixel == 1) || (image->format != ZPixmap)) {
42 dest_bits_per_pixel = 1;
43--
442.35.7
45
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch
new file mode 100644
index 0000000000..2f47fe0bf2
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch
@@ -0,0 +1,51 @@
1From b4031fc023816aca07fbd592ed97010b9b48784b Mon Sep 17 00:00:00 2001
2From: Alan Coopersmith <alan.coopersmith@oracle.com>
3Date: Thu, 7 Sep 2023 16:12:27 -0700
4Subject: [PATCH] XCreatePixmap: trigger BadValue error for out-of-range
5 dimensions
6
7The CreatePixmap request specifies height & width of the image as CARD16
8(unsigned 16-bit integer), so if either is larger than that, set it to 0
9so the X server returns a BadValue error as the protocol requires.
10
11Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
12
13Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/b4031fc023816aca07fbd592ed97010b9b48784b]
14CVE: CVE-2023-43786
15Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
16---
17 src/CrPixmap.c | 11 +++++++++++
18 1 file changed, 11 insertions(+)
19
20diff --git a/src/CrPixmap.c b/src/CrPixmap.c
21index cdf3120..3cb2ca6 100644
22--- a/src/CrPixmap.c
23+++ b/src/CrPixmap.c
24@@ -28,6 +28,7 @@ in this Software without prior written authorization from The Open Group.
25 #include <config.h>
26 #endif
27 #include "Xlibint.h"
28+#include <limits.h>
29
30 #ifdef USE_DYNAMIC_XCURSOR
31 void
32@@ -47,6 +48,16 @@ Pixmap XCreatePixmap (
33 Pixmap pid;
34 register xCreatePixmapReq *req;
35
36+ /*
37+ * Force a BadValue X Error if the requested dimensions are larger
38+ * than the X11 protocol has room for, since that's how callers expect
39+ * to get notified of errors.
40+ */
41+ if (width > USHRT_MAX)
42+ width = 0;
43+ if (height > USHRT_MAX)
44+ height = 0;
45+
46 LockDisplay(dpy);
47 GetReq(CreatePixmap, req);
48 req->drawable = d;
49--
502.35.7
51
diff --git a/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch
new file mode 100644
index 0000000000..4b5cd694ab
--- /dev/null
+++ b/meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch
@@ -0,0 +1,63 @@
1From 7916869d16bdd115ac5be30a67c3749907aea6a0 Mon Sep 17 00:00:00 2001
2From: Yair Mizrahi <yairm@jfrog.com>
3Date: Thu, 7 Sep 2023 16:15:32 -0700
4Subject: [PATCH] CVE-2023-43787: Integer overflow in XCreateImage() leading to
5 a heap overflow
6
7When the format is `Pixmap` it calculates the size of the image data as:
8 ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
9There is no validation on the `width` of the image, and so this
10calculation exceeds the capacity of a 4-byte integer, causing an overflow.
11
12Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
13
14Upstream-Status: Backport from [https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/7916869d16bdd115ac5be30a67c3749907aea6a0]
15CVE: CVE-2023-43787
16Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
17---
18 src/ImUtil.c | 20 +++++++++++++++-----
19 1 file changed, 15 insertions(+), 5 deletions(-)
20
21diff --git a/src/ImUtil.c b/src/ImUtil.c
22index 36f08a0..fbfad33 100644
23--- a/src/ImUtil.c
24+++ b/src/ImUtil.c
25@@ -30,6 +30,7 @@ in this Software without prior written authorization from The Open Group.
26 #include <X11/Xlibint.h>
27 #include <X11/Xutil.h>
28 #include <stdio.h>
29+#include <limits.h>
30 #include "ImUtil.h"
31
32 static int _XDestroyImage(XImage *);
33@@ -361,13 +362,22 @@ XImage *XCreateImage (
34 /*
35 * compute per line accelerator.
36 */
37- {
38- if (format == ZPixmap)
39+ if (format == ZPixmap) {
40+ if ((INT_MAX / bits_per_pixel) < width) {
41+ Xfree(image);
42+ return NULL;
43+ }
44+
45 min_bytes_per_line =
46- ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
47- else
48+ ROUNDUP((bits_per_pixel * width), image->bitmap_pad);
49+ } else {
50+ if ((INT_MAX - offset) < width) {
51+ Xfree(image);
52+ return NULL;
53+ }
54+
55 min_bytes_per_line =
56- ROUNDUP((width + offset), image->bitmap_pad);
57+ ROUNDUP((width + offset), image->bitmap_pad);
58 }
59 if (image_bytes_per_line == 0) {
60 image->bytes_per_line = min_bytes_per_line;
61--
622.35.7
63
diff --git a/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb b/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb
index 19687d546b..d783f60103 100644
--- a/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb
+++ b/meta/recipes-graphics/xorg-lib/libx11_1.7.3.1.bb
@@ -18,6 +18,11 @@ SRC_URI += "file://disable_tests.patch \
18 file://CVE-2022-3554.patch \ 18 file://CVE-2022-3554.patch \
19 file://CVE-2022-3555.patch \ 19 file://CVE-2022-3555.patch \
20 file://CVE-2023-3138.patch \ 20 file://CVE-2023-3138.patch \
21 file://CVE-2023-43785.patch \
22 file://CVE-2023-43786-0001.patch \
23 file://CVE-2023-43786-0002.patch \
24 file://CVE-2023-43786-0003.patch \
25 file://CVE-2023-43787.patch \
21 " 26 "
22SRC_URI[sha256sum] = "2ffd417266fb875028fdc0ef349694f63dbcd76d0b0cfacfb52e6151f4b60989" 27SRC_URI[sha256sum] = "2ffd417266fb875028fdc0ef349694f63dbcd76d0b0cfacfb52e6151f4b60989"
23 28
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-07 04:33:28 +0000