From efca605c45ff51b57f136222b966ce1d610ebc33 Mon Sep 17 00:00:00 2001 From: Olivier Fourdan Date: Wed, 27 Nov 2024 11:27:05 +0100 Subject: [PATCH xserver 1/2] Cursor: Refuse to free the root cursor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If a cursor reference count drops to 0, the cursor is freed. The root cursor however is referenced with a specific global variable, and when the root cursor is freed, the global variable may still point to freed memory. Make sure to prevent the rootCursor from being explicitly freed by a client. CVE-2025-26594, ZDI-CAN-25544 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative v2: Explicitly forbid XFreeCursor() on the root cursor (Peter Hutterer ) v3: Return BadCursor instead of BadValue (Michel Dänzer ) Signed-off-by: Olivier Fourdan Suggested-by: Peter Hutterer Reviewed-by: Peter Hutterer --- dix/dispatch.c | 4 ++++ 1 file changed, 4 insertions(+) Index: xwayland-24.1.4/dix/dispatch.c =================================================================== --- xwayland-24.1.4.orig/dix/dispatch.c +++ xwayland-24.1.4/dix/dispatch.c @@ -3106,6 +3106,10 @@ ProcFreeCursor(ClientPtr client) rc = dixLookupResourceByType((void **) &pCursor, stuff->id, RT_CURSOR, client, DixDestroyAccess); if (rc == Success) { + if (pCursor == rootCursor) { + client->errorValue = stuff->id; + return BadCursor; + } FreeResource(stuff->id, RT_NONE); return Success; }