xorg-x11-server: Add patch for CVE-2023-1594 (#5990)
This commit is contained in:
parent
74e299b0b8
commit
a2f20dcbad
|
@ -0,0 +1,42 @@
|
||||||
|
From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||||
|
Date: Mon, 13 Mar 2023 11:08:47 +0100
|
||||||
|
Subject: [PATCH] composite: Fix use-after-free of the COW
|
||||||
|
|
||||||
|
ZDI-CAN-19866/CVE-2023-1393
|
||||||
|
|
||||||
|
If a client explicitly destroys the compositor overlay window (aka COW),
|
||||||
|
we would leave a dangling pointer to that window in the CompScreen
|
||||||
|
structure, which will trigger a use-after-free later.
|
||||||
|
|
||||||
|
Make sure to clear the CompScreen pointer to the COW when the latter gets
|
||||||
|
destroyed explicitly by the client.
|
||||||
|
|
||||||
|
This vulnerability was discovered by:
|
||||||
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||||
|
|
||||||
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||||
|
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||||
|
---
|
||||||
|
composite/compwindow.c | 5 +++++
|
||||||
|
1 file changed, 5 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/composite/compwindow.c b/composite/compwindow.c
|
||||||
|
index 4e2494b86b..b30da589e9 100644
|
||||||
|
--- a/composite/compwindow.c
|
||||||
|
+++ b/composite/compwindow.c
|
||||||
|
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
|
||||||
|
ret = (*pScreen->DestroyWindow) (pWin);
|
||||||
|
cs->DestroyWindow = pScreen->DestroyWindow;
|
||||||
|
pScreen->DestroyWindow = compDestroyWindow;
|
||||||
|
+
|
||||||
|
+ /* Did we just destroy the overlay window? */
|
||||||
|
+ if (pWin == cs->pOverlayWin)
|
||||||
|
+ cs->pOverlayWin = NULL;
|
||||||
|
+
|
||||||
|
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
GitLab
|
||||||
|
|
|
@ -21,7 +21,7 @@
|
||||||
Summary: X.Org X11 X server
|
Summary: X.Org X11 X server
|
||||||
Name: xorg-x11-server
|
Name: xorg-x11-server
|
||||||
Version: 1.20.10
|
Version: 1.20.10
|
||||||
Release: 3%{?dist}
|
Release: 4%{?dist}
|
||||||
License: MIT
|
License: MIT
|
||||||
Vendor: Microsoft Corporation
|
Vendor: Microsoft Corporation
|
||||||
Distribution: Mariner
|
Distribution: Mariner
|
||||||
|
@ -53,7 +53,7 @@ Patch6: 0001-Fedora-hack-Make-the-suid-root-wrapper-always-start-.patch
|
||||||
# <empty>
|
# <empty>
|
||||||
|
|
||||||
# Backports from "master" upstream:
|
# Backports from "master" upstream:
|
||||||
# <empty>
|
Patch7: CVE-2023-1594.patch
|
||||||
|
|
||||||
# Backported Xwayland randr resolution change emulation support
|
# Backported Xwayland randr resolution change emulation support
|
||||||
Patch501: 0001-dix-Add-GetCurrentClient-helper.patch
|
Patch501: 0001-dix-Add-GetCurrentClient-helper.patch
|
||||||
|
@ -384,6 +384,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
|
||||||
%{_datadir}/aclocal/xorg-server.m4
|
%{_datadir}/aclocal/xorg-server.m4
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Aug 11 2023 Sean Dougherty <sdougherty@microsoft.com> - 1.20.10-4
|
||||||
|
- Add patch for CVE-2023-1594
|
||||||
|
|
||||||
* Fri Nov 05 2021 Muhammad Falak <mwani@microsft.com> - 0.13.0.7-4
|
* Fri Nov 05 2021 Muhammad Falak <mwani@microsft.com> - 0.13.0.7-4
|
||||||
- Remove epoch from xorg-x11-font-utils
|
- Remove epoch from xorg-x11-font-utils
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue