From c58209dd0b033847890b5e0f1f2d6ea3b79150731973e052f2a4c0e429097461 Mon Sep 17 00:00:00 2001 From: Dominique Leuenberger Date: Wed, 15 Aug 2018 09:09:55 +0000 Subject: [PATCH] Accepting request 629349 from home:zhangxiaofei:branches:GNOME:Factory - Add gdm-CVE-2018-14424.patch: Pass the display object rather than the id in the removed signal, fix use-after-free of disposed transient displays (CVE-2018-14424, glgo#GNOME#gdm#401, boo#1103737). OBS-URL: https://build.opensuse.org/request/show/629349 OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/gdm?expand=0&rev=409 --- gdm-CVE-2018-14424.patch | 163 +++++++++++++++++++++++++++++++++++++++ gdm.changes | 10 ++- gdm.spec | 3 + 3 files changed, 175 insertions(+), 1 deletion(-) create mode 100644 gdm-CVE-2018-14424.patch diff --git a/gdm-CVE-2018-14424.patch b/gdm-CVE-2018-14424.patch new file mode 100644 index 0000000..2c32e7e --- /dev/null +++ b/gdm-CVE-2018-14424.patch @@ -0,0 +1,163 @@ +From 1ac1697b3b019f50729a6e992065959586e170da Mon Sep 17 00:00:00 2001 +From: Chris Coulson +Date: Thu, 19 Jul 2018 18:26:05 +0100 +Subject: [PATCH] display-store: Pass the display object rather than the id in + the removed signal + +By the time GdmDisplayStore emits the "display-removed" signal, the display +is no longer in the store and gdm_display_store_lookup will not work in +signal handlers. + +Change the "display-removed" parameter from the display id to the GdmDisplay +object, so that signal handers can perform any cleanup they need to do + +CVE-2018-14424 + +Closes: https://gitlab.gnome.org/GNOME/gdm/issues/401 +--- + daemon/gdm-display-store.c | 11 +++-------- + daemon/gdm-display-store.h | 2 +- + daemon/gdm-local-display-factory.c | 13 +++---------- + daemon/gdm-manager.c | 19 +++++++++---------- + daemon/gdm-manager.h | 3 ++- + 5 files changed, 18 insertions(+), 30 deletions(-) + +diff --git a/daemon/gdm-display-store.c b/daemon/gdm-display-store.c +index af76f519..fd24334e 100644 +--- a/daemon/gdm-display-store.c ++++ b/daemon/gdm-display-store.c +@@ -76,15 +76,10 @@ stored_display_new (GdmDisplayStore *store, + static void + stored_display_free (StoredDisplay *stored_display) + { +- char *id; +- +- gdm_display_get_id (stored_display->display, &id, NULL); +- + g_signal_emit (G_OBJECT (stored_display->store), + signals[DISPLAY_REMOVED], + 0, +- id); +- g_free (id); ++ stored_display->display); + + g_debug ("GdmDisplayStore: Unreffing display: %p", + stored_display->display); +@@ -281,9 +276,9 @@ gdm_display_store_class_init (GdmDisplayStoreClass *klass) + G_STRUCT_OFFSET (GdmDisplayStoreClass, display_removed), + NULL, + NULL, +- g_cclosure_marshal_VOID__STRING, ++ g_cclosure_marshal_VOID__OBJECT, + G_TYPE_NONE, +- 1, G_TYPE_STRING); ++ 1, G_TYPE_OBJECT); + + g_type_class_add_private (klass, sizeof (GdmDisplayStorePrivate)); + } +diff --git a/daemon/gdm-display-store.h b/daemon/gdm-display-store.h +index 28359933..0aff8ee2 100644 +--- a/daemon/gdm-display-store.h ++++ b/daemon/gdm-display-store.h +@@ -49,7 +49,7 @@ typedef struct + void (* display_added) (GdmDisplayStore *display_store, + const char *id); + void (* display_removed) (GdmDisplayStore *display_store, +- const char *id); ++ GdmDisplay *display); + } GdmDisplayStoreClass; + + typedef enum +diff --git a/daemon/gdm-local-display-factory.c b/daemon/gdm-local-display-factory.c +index 5f1ae89e..39f3e30a 100644 +--- a/daemon/gdm-local-display-factory.c ++++ b/daemon/gdm-local-display-factory.c +@@ -805,18 +805,11 @@ on_display_added (GdmDisplayStore *display_store, + + static void + on_display_removed (GdmDisplayStore *display_store, +- const char *id, ++ GdmDisplay *display, + GdmLocalDisplayFactory *factory) + { +- GdmDisplay *display; +- +- display = gdm_display_store_lookup (display_store, id); +- +- if (display != NULL) { +- g_signal_handlers_disconnect_by_func (display, G_CALLBACK (on_display_status_changed), factory); +- g_object_weak_unref (G_OBJECT (display), (GWeakNotify)on_display_disposed, factory); +- +- } ++ g_signal_handlers_disconnect_by_func (display, G_CALLBACK (on_display_status_changed), factory); ++ g_object_weak_unref (G_OBJECT (display), (GWeakNotify)on_display_disposed, factory); + } + + static gboolean +diff --git a/daemon/gdm-manager.c b/daemon/gdm-manager.c +index f17bd1a5..f6684a8b 100644 +--- a/daemon/gdm-manager.c ++++ b/daemon/gdm-manager.c +@@ -1541,19 +1541,18 @@ on_display_status_changed (GdmDisplay *display, + + static void + on_display_removed (GdmDisplayStore *display_store, +- const char *id, ++ GdmDisplay *display, + GdmManager *manager) + { +- GdmDisplay *display; ++ char *id; + +- display = gdm_display_store_lookup (display_store, id); +- if (display != NULL) { +- g_dbus_object_manager_server_unexport (manager->priv->object_manager, id); ++ gdm_display_get_id (display, &id, NULL); ++ g_dbus_object_manager_server_unexport (manager->priv->object_manager, id); ++ g_free (id); + +- g_signal_handlers_disconnect_by_func (display, G_CALLBACK (on_display_status_changed), manager); ++ g_signal_handlers_disconnect_by_func (display, G_CALLBACK (on_display_status_changed), manager); + +- g_signal_emit (manager, signals[DISPLAY_REMOVED], 0, id); +- } ++ g_signal_emit (manager, signals[DISPLAY_REMOVED], 0, display); + } + + static void +@@ -2535,9 +2534,9 @@ gdm_manager_class_init (GdmManagerClass *klass) + G_STRUCT_OFFSET (GdmManagerClass, display_removed), + NULL, + NULL, +- g_cclosure_marshal_VOID__STRING, ++ g_cclosure_marshal_VOID__OBJECT, + G_TYPE_NONE, +- 1, G_TYPE_STRING); ++ 1, G_TYPE_OBJECT); + + g_object_class_install_property (object_class, + PROP_XDMCP_ENABLED, +diff --git a/daemon/gdm-manager.h b/daemon/gdm-manager.h +index 41c68a7a..c8fb3f22 100644 +--- a/daemon/gdm-manager.h ++++ b/daemon/gdm-manager.h +@@ -24,6 +24,7 @@ + + #include + ++#include "gdm-display.h" + #include "gdm-manager-glue.h" + + G_BEGIN_DECLS +@@ -50,7 +51,7 @@ typedef struct + void (* display_added) (GdmManager *manager, + const char *id); + void (* display_removed) (GdmManager *manager, +- const char *id); ++ GdmDisplay *display); + } GdmManagerClass; + + typedef enum +-- +2.16.4 + diff --git a/gdm.changes b/gdm.changes index 18b1def..d09f3f4 100644 --- a/gdm.changes +++ b/gdm.changes @@ -1,3 +1,11 @@ +------------------------------------------------------------------- +Wed Aug 15 06:50:36 UTC 2018 - fezhang@suse.com + +- Add gdm-CVE-2018-14424.patch: Pass the display object rather than + the id in the removed signal, fix use-after-free of disposed + transient displays (CVE-2018-14424, glgo#GNOME#gdm#401, + boo#1103737). + ------------------------------------------------------------------- Tue Jul 31 12:43:52 UTC 2018 - bwiedemann@suse.com @@ -90,7 +98,7 @@ Mon Mar 12 04:46:37 UTC 2018 - yfjiang@suse.com back GNOME to X, the patch targets to provide a better user experiences for servers with mgag200 graphic chips, which suffer the sluggish keyboard/mouse issues running GNOME on wayland - (bsc#1073550 bsc#1077802). Some of the servers could not + (bsc#1073550, bsc#1077802). Some of the servers could not initiate GNOME in a similar context (bsc#1070933). With the complexity of the problem, Wayland probably needs diff --git a/gdm.spec b/gdm.spec index 6f929d4..7c82ddc 100644 --- a/gdm.spec +++ b/gdm.spec @@ -57,6 +57,8 @@ Patch41: gdm-plymouth-vt1.patch Patch42: gdm-fails-to-restart-gnome-shell.patch # PATCH-FIX-UPSTREAM gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch bnc#1075805 bgo#793255 msrb@suse.com -- Add runtime option to start X under root instead of regular user. Necessary if no DRI drivers are present. Patch43: gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch +# PATCH-FIX-UPSTREAM gdm-CVE-2018-14424.patch glgo#GNOME#gdm#401 boo#1103737 CVE-2018-14424 fezhang@suse.com -- Fix use-after-free of disposed transient displays. +Patch44: gdm-CVE-2018-14424.patch ### NOTE: Keep please SLE-only patches at bottom (starting on 1000). # PATCH-FIX-SLE gdm-disable-gnome-initial-setup.patch bnc#1067976 qzhao@suse.com -- Disable gnome-initial-setup runs before gdm, g-i-s will only serve for CJK people to choose the input-method after login. Patch1002: gdm-disable-gnome-initial-setup.patch @@ -200,6 +202,7 @@ cp %{SOURCE8} . %patch41 -p1 %patch42 -p1 %patch43 -p1 +%patch44 -p1 # SLE-only patches start at 1000 %if !0%{?is_opensuse} %patch1002 -p1