xorg-x11-server: Add patch for CVE-2023-1594 (#5990)
This commit is contained in:
parent
74e299b0b8
commit
a2f20dcbad
|
@ -0,0 +1,42 @@
|
|||
From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
|
||||
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Date: Mon, 13 Mar 2023 11:08:47 +0100
|
||||
Subject: [PATCH] composite: Fix use-after-free of the COW
|
||||
|
||||
ZDI-CAN-19866/CVE-2023-1393
|
||||
|
||||
If a client explicitly destroys the compositor overlay window (aka COW),
|
||||
we would leave a dangling pointer to that window in the CompScreen
|
||||
structure, which will trigger a use-after-free later.
|
||||
|
||||
Make sure to clear the CompScreen pointer to the COW when the latter gets
|
||||
destroyed explicitly by the client.
|
||||
|
||||
This vulnerability was discovered by:
|
||||
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||
|
||||
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||
---
|
||||
composite/compwindow.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/composite/compwindow.c b/composite/compwindow.c
|
||||
index 4e2494b86b..b30da589e9 100644
|
||||
--- a/composite/compwindow.c
|
||||
+++ b/composite/compwindow.c
|
||||
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
|
||||
ret = (*pScreen->DestroyWindow) (pWin);
|
||||
cs->DestroyWindow = pScreen->DestroyWindow;
|
||||
pScreen->DestroyWindow = compDestroyWindow;
|
||||
+
|
||||
+ /* Did we just destroy the overlay window? */
|
||||
+ if (pWin == cs->pOverlayWin)
|
||||
+ cs->pOverlayWin = NULL;
|
||||
+
|
||||
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
|
||||
return ret;
|
||||
}
|
||||
--
|
||||
GitLab
|
||||
|
|
@ -21,7 +21,7 @@
|
|||
Summary: X.Org X11 X server
|
||||
Name: xorg-x11-server
|
||||
Version: 1.20.10
|
||||
Release: 3%{?dist}
|
||||
Release: 4%{?dist}
|
||||
License: MIT
|
||||
Vendor: Microsoft Corporation
|
||||
Distribution: Mariner
|
||||
|
@ -53,7 +53,7 @@ Patch6: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch
|
|||
# <empty>
|
||||
|
||||
# Backports from "master" upstream:
|
||||
# <empty>
|
||||
Patch7: CVE-2023-1594.patch
|
||||
|
||||
# Backported Xwayland randr resolution change emulation support
|
||||
Patch501: 0001-dix-Add-GetCurrentClient-helper.patch
|
||||
|
@ -384,6 +384,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
|
|||
%{_datadir}/aclocal/xorg-server.m4
|
||||
|
||||
%changelog
|
||||
* Fri Aug 11 2023 Sean Dougherty <sdougherty@microsoft.com> - 1.20.10-4
|
||||
- Add patch for CVE-2023-1594
|
||||
|
||||
* Fri Nov 05 2021 Muhammad Falak <mwani@microsft.com> - 0.13.0.7-4
|
||||
- Remove epoch from xorg-x11-font-utils
|
||||
|
||||
|
|
Loading…
Reference in New Issue