Accepting request 1075267 from X11:XOrg

This can be checked in now https://lists.x.org/archives/xorg-announce/2023-March/003374.html

- U_xserver-composite-Fix-use-after-free-of-the-COW.patch
  * overlay window use-after-free (CVE-2023-1393, ZDI-CAN-19866,
    bsc#1209543)

OBS-URL: https://build.opensuse.org/request/show/1075267
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/xorg-x11-server?expand=0&rev=418

U_xserver-composite-Fix-use-after-free-of-the-COW.patch

@@ -0,0 +1,42 @@
+From 947bd1b3f4a23565bf10879ec41ba06ebe1e1c76 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Mar 2023 11:08:47 +0100
+Subject: [PATCH xserver] composite: Fix use-after-free of the COW
+
+ZDI-CAN-19866/CVE-2023-1393
+
+If a client explicitly destroys the compositor overlay window (aka COW),
+we would leave a dangling pointer to that window in the CompScreen
+structure, which will trigger a use-after-free later.
+
+Make sure to clear the CompScreen pointer to the COW when the latter gets
+destroyed explicitly by the client.
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Adam Jackson <ajax@redhat.com>
+---
+ composite/compwindow.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/composite/compwindow.c b/composite/compwindow.c
+index 4e2494b86..b30da589e 100644
+--- a/composite/compwindow.c
++++ b/composite/compwindow.c
+@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
+     ret = (*pScreen->DestroyWindow) (pWin);
+     cs->DestroyWindow = pScreen->DestroyWindow;
+     pScreen->DestroyWindow = compDestroyWindow;
++
++    /* Did we just destroy the overlay window? */
++    if (pWin == cs->pOverlayWin)
++        cs->pOverlayWin = NULL;
++
+ /*    compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
+     return ret;
+ }
+-- 
+2.40.0
+

xorg-x11-server.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Wed Mar 22 13:48:21 UTC 2023 - Stefan Dirsch <sndirsch@suse.com>
+
+- U_xserver-composite-Fix-use-after-free-of-the-COW.patch
+  * overlay window use-after-free (CVE-2023-1393, ZDI-CAN-19866,
+    bsc#1209543)
+
 -------------------------------------------------------------------
 Tue Feb  7 14:35:33 UTC 2023 - Stefan Dirsch <sndirsch@suse.com>
 

xorg-x11-server.spec

@@ -242,6 +242,8 @@ Patch1940:      U_xephyr-Don-t-check-for-SeatId-anymore.patch
 
 Patch1960:      u_sync-pci-ids-with-Mesa.patch
 
+Patch1209543:   U_xserver-composite-Fix-use-after-free-of-the-COW.patch
+
 %description
 This package contains the X.Org Server.
 
@@ -400,6 +402,8 @@ sh %{SOURCE92} --verify . %{SOURCE91}
 %patch1940 -p1
 %patch1960 -p1
 
+%patch1209543 -p1
+
 %build
 # We have some -z now related errors during X default startup (boo#1197994):
 # - when loading modesetting: gbm_bo_get_plane_count