From 83be5d2e19d4096b7b3d8c39b58c121fd543a309eec77eaf9f990bd2f0abfed9 Mon Sep 17 00:00:00 2001 From: Stefan Dirsch Date: Sat, 1 Apr 2023 17:58:43 +0000 Subject: [PATCH] Accepting request 1076649 from home:iznogood:branches:X11:XOrg - Update to version 23.1.1 (CVE-2023-1393): + This release contains the fix for CVE-2023-1393. + xkbUtils: use existing symbol names instead of deleted deprecated ones + glamor: Don't glFlush/ctx switch unless any work has been performed + xwayland: - Refactor xwl_present_for_each_frame_callback helper - Prevent nested xwl_present_for_each_frame_callback calls + composite: Fix use-after-free of the COW - Drop U_xserver-composite-Fix-use-after-free-of-the-COW.patch: Fixed upstream. OBS-URL: https://build.opensuse.org/request/show/1076649 OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xwayland?expand=0&rev=50 --- ...posite-Fix-use-after-free-of-the-COW.patch | 42 ------------------ xwayland-23.1.0.tar.xz | 3 -- xwayland-23.1.0.tar.xz.sig | Bin 95 -> 0 bytes xwayland-23.1.1.tar.xz | 3 ++ xwayland-23.1.1.tar.xz.sig | Bin 0 -> 95 bytes xwayland.changes | 16 +++++++ xwayland.spec | 5 +-- 7 files changed, 21 insertions(+), 48 deletions(-) delete mode 100644 U_xserver-composite-Fix-use-after-free-of-the-COW.patch delete mode 100644 xwayland-23.1.0.tar.xz delete mode 100644 xwayland-23.1.0.tar.xz.sig create mode 100644 xwayland-23.1.1.tar.xz create mode 100644 xwayland-23.1.1.tar.xz.sig diff --git a/U_xserver-composite-Fix-use-after-free-of-the-COW.patch b/U_xserver-composite-Fix-use-after-free-of-the-COW.patch deleted file mode 100644 index 3473094..0000000 --- a/U_xserver-composite-Fix-use-after-free-of-the-COW.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 947bd1b3f4a23565bf10879ec41ba06ebe1e1c76 Mon Sep 17 00:00:00 2001 -From: Olivier Fourdan -Date: Mon, 13 Mar 2023 11:08:47 +0100 -Subject: [PATCH xserver] composite: Fix use-after-free of the COW - -ZDI-CAN-19866/CVE-2023-1393 - -If a client explicitly destroys the compositor overlay window (aka COW), -we would leave a dangling pointer to that window in the CompScreen -structure, which will trigger a use-after-free later. - -Make sure to clear the CompScreen pointer to the COW when the latter gets -destroyed explicitly by the client. - -This vulnerability was discovered by: -Jan-Niklas Sohn working with Trend Micro Zero Day Initiative - -Signed-off-by: Olivier Fourdan -Reviewed-by: Adam Jackson ---- - composite/compwindow.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/composite/compwindow.c b/composite/compwindow.c -index 4e2494b86..b30da589e 100644 ---- a/composite/compwindow.c -+++ b/composite/compwindow.c -@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin) - ret = (*pScreen->DestroyWindow) (pWin); - cs->DestroyWindow = pScreen->DestroyWindow; - pScreen->DestroyWindow = compDestroyWindow; -+ -+ /* Did we just destroy the overlay window? */ -+ if (pWin == cs->pOverlayWin) -+ cs->pOverlayWin = NULL; -+ - /* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ - return ret; - } --- -2.40.0 - diff --git a/xwayland-23.1.0.tar.xz b/xwayland-23.1.0.tar.xz deleted file mode 100644 index 658c338..0000000 --- a/xwayland-23.1.0.tar.xz +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:40e0a0c050446ac558ec0f54be4930ffef6be63c6ea980fb654f264ef065af9e -size 1286056 diff --git a/xwayland-23.1.0.tar.xz.sig b/xwayland-23.1.0.tar.xz.sig deleted file mode 100644 index 079fdf6c5cda391c0fe2a643296ccfd1a594d1c16d65224ec9fa2032e7531f1f..0000000000000000000000000000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 95 zcmeB(WnmCxVvrS6WJ$l%_9@B!=wI)xO0gmZx%=e2T^(4NQlzD}FmQ1Sz(kTw85X=x w7Tg@mx9Cp(fsHHIzh_zhdCE!whIzKxR|CFY-mrak)AtDN#9WsBzh2D)05;nvH~;_u diff --git a/xwayland-23.1.1.tar.xz b/xwayland-23.1.1.tar.xz new file mode 100644 index 0000000..9752b41 --- /dev/null +++ b/xwayland-23.1.1.tar.xz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:fb9461f5cb9fea5e07e91882311b0c88b43e8843b017ebac05eb5af69aa34c15 +size 1286460 diff --git a/xwayland-23.1.1.tar.xz.sig b/xwayland-23.1.1.tar.xz.sig new file mode 100644 index 0000000000000000000000000000000000000000000000000000000000000000..e7c96022ea97b591e0f406df341f469c5208880b2a1347244fa3cfca76192806 GIT binary patch literal 95 zcmeB(WnmCxVvrS6WJ$l%_9@B!=wI)xO0gmZx%=e2T^(4NQdF#%8MrtFU?S)B8Rkbl veR!F1Ud^1Q1N$Wpu9Q>=n{BdS literal 0 HcmV?d00001 diff --git a/xwayland.changes b/xwayland.changes index 6c0549d..a753b74 100644 --- a/xwayland.changes +++ b/xwayland.changes @@ -1,3 +1,19 @@ +------------------------------------------------------------------- +Sat Apr 1 11:35:04 UTC 2023 - Bjørn Lie + +- Update to version 23.1.1 (CVE-2023-1393): + + This release contains the fix for CVE-2023-1393. + + xkbUtils: use existing symbol names instead of deleted + deprecated ones + + glamor: Don't glFlush/ctx switch unless any work has been + performed + + xwayland: + - Refactor xwl_present_for_each_frame_callback helper + - Prevent nested xwl_present_for_each_frame_callback calls + + composite: Fix use-after-free of the COW +- Drop U_xserver-composite-Fix-use-after-free-of-the-COW.patch: + Fixed upstream. + ------------------------------------------------------------------- Thu Mar 23 12:32:18 UTC 2023 - Stefan Dirsch diff --git a/xwayland.spec b/xwayland.spec index d6c0964..5525d21 100644 --- a/xwayland.spec +++ b/xwayland.spec @@ -24,7 +24,7 @@ %endif Name: xwayland -Version: 23.1.0 +Version: 23.1.1 Release: 0 URL: http://xorg.freedesktop.org Summary: Xwayland Xserver @@ -33,7 +33,6 @@ Group: System/X11/Servers/XF86_4 Source0: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz Source1: %{url}/archive/individual/xserver/%{name}-%{version}.tar.xz.sig Source2: xwayland.keyring -Patch1209543: U_xserver-composite-Fix-use-after-free-of-the-COW.patch BuildRequires: meson BuildRequires: ninja @@ -66,7 +65,7 @@ BuildRequires: pkgconfig(renderproto) BuildRequires: pkgconfig(resourceproto) BuildRequires: pkgconfig(scrnsaverproto) BuildRequires: pkgconfig(videoproto) -BuildRequires: pkgconfig(wayland-client) +BuildRequires: pkgconfig(wayland-client) >= 1.21.0 BuildRequires: pkgconfig(wayland-protocols) %if 0%{?have_wayland_eglstream} == 1 BuildRequires: pkgconfig(wayland-eglstream-protocols)