forked from pool/xorg-x11-server
Stefan Dirsch
37722e6dc6
* XkbGetKbdByName use-after-free (ZDI-CAN-19530, CVE-2022-4283,
bsc#1206017)
- U_0001-Xtest-disallow-GenericEvents-in-XTestSwapFakeInput.patch
* Server XTestSwapFakeInput stack overflow (ZDI-CAN 19265,
CVE-2022-46340, bsc#1205874)
- U_0002-Xi-return-an-error-from-XI-property-changes-if-verif.patch
* Xi: return an error from XI property changes if verification
failed (no ZDI-CAN id, no CVE id, bsc#1205875)
- U_0003-Xi-avoid-integer-truncation-in-length-check-of-ProcX.patch
* Server XIChangeProperty out-of-bounds access (ZDI-CAN 19405,
CVE-2022-46344, bsc#1205876)
- U_0004-Xi-disallow-passive-grabs-with-a-detail-255.patch
* Server XIPassiveUngrabDevice out-of-bounds access (ZDI-CAN 19381,
CVE-2022-46341, bsc#1205877)
- U_0005-Xext-free-the-screen-saver-resource-when-replacing-i.patch
* Server ScreenSaverSetAttributes use-after-free (ZDI-CAN 19404,
CVE-2022-46343, bsc#1205878)
- U_0006-Xext-free-the-XvRTVideoNotify-when-turning-off-from-.patch
* Server XvdiSelectVideoNotify use-after-free (ZDI-CAN 19400,
CVE-2022-46342, bsc#1205879)
OBS-URL: https://build.opensuse.org/package/show/X11:XOrg/xorg-x11-server?expand=0&rev=843
52 lines
1.8 KiB
Diff
52 lines
1.8 KiB
Diff
From 2e8916efe9a8566f97a4c2231891ad0f555fced1 Mon Sep 17 00:00:00 2001
|
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Date: Tue, 29 Nov 2022 12:55:45 +1000
|
|
Subject: [PATCH xserver 1/6] Xtest: disallow GenericEvents in
|
|
XTestSwapFakeInput
|
|
|
|
XTestSwapFakeInput assumes all events in this request are
|
|
sizeof(xEvent) and iterates through these in 32-byte increments.
|
|
However, a GenericEvent may be of arbitrary length longer than 32 bytes,
|
|
so any GenericEvent in this list would result in subsequent events to be
|
|
misparsed.
|
|
|
|
Additional, the swapped event is written into a stack-allocated struct
|
|
xEvent (size 32 bytes). For any GenericEvent longer than 32 bytes,
|
|
swapping the event may thus smash the stack like an avocado on toast.
|
|
|
|
Catch this case early and return BadValue for any GenericEvent.
|
|
Which is what would happen in unswapped setups anyway since XTest
|
|
doesn't support GenericEvent.
|
|
|
|
ZDI-CAN 19265
|
|
|
|
This vulnerability was discovered by:
|
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
|
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
---
|
|
Xext/xtest.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/Xext/xtest.c b/Xext/xtest.c
|
|
index bf27eb590b..2985a4ce6e 100644
|
|
--- a/Xext/xtest.c
|
|
+++ b/Xext/xtest.c
|
|
@@ -502,10 +502,11 @@ XTestSwapFakeInput(ClientPtr client, xReq * req)
|
|
|
|
nev = ((req->length << 2) - sizeof(xReq)) / sizeof(xEvent);
|
|
for (ev = (xEvent *) &req[1]; --nev >= 0; ev++) {
|
|
+ int evtype = ev->u.u.type & 0x177;
|
|
/* Swap event */
|
|
- proc = EventSwapVector[ev->u.u.type & 0177];
|
|
+ proc = EventSwapVector[evtype];
|
|
/* no swapping proc; invalid event type? */
|
|
- if (!proc || proc == NotImplemented) {
|
|
+ if (!proc || proc == NotImplemented || evtype == GenericEvent) {
|
|
client->errorValue = ev->u.u.type;
|
|
return BadValue;
|
|
}
|
|
--
|
|
2.38.1
|
|
|