[Git][xorg-team/wayland/xwayland][upstream-unstable] 2 commits: xkb: Fix buffer overflow in _XkbSetCompatMap()

["Timo Aaltonen (@tjaalton)" <gitlab@salsa.debian.org>]

Title: GitLab

Timo Aaltonen pushed to branch upstream-unstable at X Strike Force / wayland / xwayland

Commits:

• 26120df7
  by Matthieu Herrb at 2024-10-29T16:26:59+01:00

  xkb: Fix buffer overflow in _XkbSetCompatMap()
  
  The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
  buffer.
  
  However, It didn't update its size properly. It updated `num_si` only,
  without updating `size_si`.
  
  This may lead to local privilege escalation if the server is run as root
  or remote code execution (e.g. x11 over ssh).
  
  CVE-2024-9632, ZDI-CAN-24756
  
  This vulnerability was discovered by:
  Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
  
  Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
  Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
  Reviewed-by: José Expósito <jexposit@redhat.com>
  (cherry picked from commit 85b776571487f52e756f68a069c768757369bfe3)
  
  Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1735>
  

• 3bfef8d7
  by José Expósito at 2024-10-29T16:27:04+01:00

  Bump version to 24.1.4
  
  Signed-off-by: José Expósito <jexposit@redhat.com>
  Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1735>
  

2 changed files:

• meson.build
• xkb/xkb.c

Changes:

meson.build

---

...	...	@@ -3,10 +3,10 @@ project('xwayland', 'c',
3	3	'buildtype=debugoptimized',
4	4	'c_std=gnu99',
5	5	],
6		- version: '24.1.3',
	6	+ version: '24.1.4',
7	7	meson_version: '>= 0.56.0',
8	8	)
9		-release_date = '2024-10-02'
	9	+release_date = '2024-10-29'
10	10
11	11	add_project_arguments('-DHAVE_DIX_CONFIG_H', language: ['c', 'objc'])
12	12	cc = meson.get_compiler('c')

xkb/xkb.c

---

...	...	@@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
2990	2990	XkbSymInterpretPtr sym;
2991	2991	unsigned int skipped = 0;
2992	2992
2993		- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
2994		- compat->num_si = req->firstSI + req->nSI;
	2993	+ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
	2994	+ compat->num_si = compat->size_si = req->firstSI + req->nSI;
2995	2995	compat->sym_interpret = reallocarray(compat->sym_interpret,
2996		- compat->num_si,
	2996	+ compat->size_si,
2997	2997	sizeof(XkbSymInterpretRec));
2998	2998	if (!compat->sym_interpret) {
2999		- compat->num_si = 0;
	2999	+ compat->num_si = compat->size_si = 0;
3000	3000	return BadAlloc;
3001	3001	}
3002	3002	}

—
View it on GitLab.
You're receiving this email because of your account on salsa.debian.org. Manage all notifications · Help