diff --git a/0001-render-Avoid-0-or-less-animated-cursors.patch b/0001-render-Avoid-0-or-less-animated-cursors.patch new file mode 100644 index 0000000000000000000000000000000000000000..ca18d6a47eab4912b067f52891f66e1b94b26261 --- /dev/null +++ b/0001-render-Avoid-0-or-less-animated-cursors.patch @@ -0,0 +1,89 @@ +From 9a7d922dc973f9bdc5e08e578d3c6d04fe9af4c6 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Fri, 28 Mar 2025 09:43:52 +0100 +Subject: [PATCH xserver 1/7] render: Avoid 0 or less animated cursors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Animated cursors use a series of cursors that the client can set. + +By default, the Xserver assumes at least one cursor is specified +while a client may actually pass no cursor at all. + +That causes an out-of-bound read creating the animated cursor and a +crash of the Xserver: + + | Invalid read of size 8 + | at 0x5323F4: AnimCursorCreate (animcur.c:325) + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd + | at 0x48468D3: reallocarray (vg_replace_malloc.c:1803) + | by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | + | Invalid read of size 2 + | at 0x5323F7: AnimCursorCreate (animcur.c:325) + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | Address 0x8 is not stack'd, malloc'd or (recently) free'd + +To avoid the issue, check the number of cursors specified and return a +BadValue error in both the proc handler (early) and the animated cursor +creation (as this is a public function) if there is 0 or less cursor. + +CVE-2025-49175 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: José Expósito +(cherry picked from commit 0885e0b26225c90534642fe911632ec0779eebee) + +Part-of: +--- + render/animcur.c | 3 +++ + render/render.c | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/render/animcur.c b/render/animcur.c +index ef27bda27..77942d846 100644 +--- a/render/animcur.c ++++ b/render/animcur.c +@@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor, + int rc = BadAlloc, i; + AnimCurPtr ac; + ++ if (ncursor <= 0) ++ return BadValue; ++ + for (i = 0; i < screenInfo.numScreens; i++) + if (!GetAnimCurScreen(screenInfo.screens[i])) + return BadImplementation; +diff --git a/render/render.c b/render/render.c +index 5bc2a204b..a8c2da056 100644 +--- a/render/render.c ++++ b/render/render.c +@@ -1795,6 +1795,8 @@ ProcRenderCreateAnimCursor(ClientPtr client) + ncursor = + (client->req_len - + (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1; ++ if (ncursor <= 0) ++ return BadValue; + cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32)); + if (!cursors) + return BadAlloc; +-- +2.49.0 + diff --git a/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch b/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch new file mode 100644 index 0000000000000000000000000000000000000000..7468bf54620b00b101cc10235fd523cae42a3e75 --- /dev/null +++ b/0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch @@ -0,0 +1,91 @@ +From c9d5eda950c7da826c387b64df3ce447ed6c5460 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 7 Apr 2025 16:13:34 +0200 +Subject: [PATCH xserver 2/7] os: Do not overflow the integer size with + BigRequest +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The BigRequest extension allows requests larger than the 16-bit length +limit. + +It uses integers for the request length and checks for the size not to +exceed the maxBigRequestSize limit, but does so after translating the +length to integer by multiplying the given size in bytes by 4. + +In doing so, it might overflow the integer size limit before actually +checking for the overflow, defeating the purpose of the test. + +To avoid the issue, make sure to check that the request size does not +overflow the maxBigRequestSize limit prior to any conversion. + +The caller Dispatch() function however expects the return value to be in +bytes, so we cannot just return the converted value in case of error, as +that would also overflow the integer size. + +To preserve the existing API, we use a negative value for the X11 error +code BadLength as the function only return positive values, 0 or -1 and +update the caller Dispatch() function to take that case into account to +return the error code to the offending client. + +CVE-2025-49176 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Michel Dänzer +(cherry picked from commit 03731b326a80b582e48d939fe62cb1e2b10400d9) + +Part-of: +--- + dix/dispatch.c | 9 +++++---- + os/io.c | 4 ++++ + 2 files changed, 9 insertions(+), 4 deletions(-) + +diff --git a/dix/dispatch.c b/dix/dispatch.c +index eaac39b7c..e37b3d0a9 100644 +--- a/dix/dispatch.c ++++ b/dix/dispatch.c +@@ -513,9 +513,10 @@ Dispatch(void) + + /* now, finally, deal with client requests */ + result = ReadRequestFromClient(client); +- if (result <= 0) { +- if (result < 0) +- CloseDownClient(client); ++ if (result == 0) ++ break; ++ else if (result == -1) { ++ CloseDownClient(client); + break; + } + +@@ -536,7 +537,7 @@ Dispatch(void) + client->index, + client->requestBuffer); + #endif +- if (result > (maxBigRequestSize << 2)) ++ if (result < 0 || result > (maxBigRequestSize << 2)) + result = BadLength; + else { + result = XaceHookDispatch(client, client->majorOp); +diff --git a/os/io.c b/os/io.c +index 841a0ee40..aeece86da 100644 +--- a/os/io.c ++++ b/os/io.c +@@ -296,6 +296,10 @@ ReadRequestFromClient(ClientPtr client) + needed = get_big_req_len(request, client); + } + client->req_len = needed; ++ if (needed > MAXINT >> 2) { ++ /* Check for potential integer overflow */ ++ return -(BadLength); ++ } + needed <<= 2; /* needed is in bytes now */ + } + if (gotnow < needed) { +-- +2.49.0 + diff --git a/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch b/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch new file mode 100644 index 0000000000000000000000000000000000000000..c7d15fdc9cd6adb73db519e66f55aac3b3e5427a --- /dev/null +++ b/0003-os-Check-for-integer-overflow-on-BigRequest-length.patch @@ -0,0 +1,35 @@ +From 07adb93cd00991a73cbaed7338104da0b5b30046 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Wed, 18 Jun 2025 08:39:02 +0200 +Subject: [PATCH xserver 3/7] os: Check for integer overflow on BigRequest + length + +Check for another possible integer overflow once we get a complete xReq +with BigRequest. + +Related to CVE-2025-49176 + +Signed-off-by: Olivier Fourdan +Suggested-by: Peter Harris +Part-of: +(cherry picked from commit 4fc4d76b2c7aaed61ed2653f997783a3714c4fe1) +--- + os/io.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/os/io.c b/os/io.c +index aeece86da..67465f943 100644 +--- a/os/io.c ++++ b/os/io.c +@@ -395,6 +395,8 @@ ReadRequestFromClient(ClientPtr client) + needed = get_big_req_len(request, client); + } + client->req_len = needed; ++ if (needed > MAXINT >> 2) ++ return -(BadLength); + needed <<= 2; + } + if (gotnow < needed) { +-- +2.49.0 + diff --git a/0004-xfixes-Check-request-length-for-SetClientDisconnectM.patch b/0004-xfixes-Check-request-length-for-SetClientDisconnectM.patch new file mode 100644 index 0000000000000000000000000000000000000000..065cda482b951f1fa01b24f027800d87302e435f --- /dev/null +++ b/0004-xfixes-Check-request-length-for-SetClientDisconnectM.patch @@ -0,0 +1,53 @@ +From 43b09814121e4b5e449fc8adca59b6ffbd521138 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 28 Apr 2025 10:05:36 +0200 +Subject: [PATCH xserver 4/7] xfixes: Check request length for + SetClientDisconnectMode + +The handler of XFixesSetClientDisconnectMode does not check the client +request length. + +A client could send a shorter request and read data from a former +request. + +Fix the issue by checking the request size matches. + +CVE-2025-49177 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Fixes: e167299f6 - xfixes: Add ClientDisconnectMode +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +(cherry picked from commit ab02fb96b1c701c3bb47617d965522c34befa6af) + +Part-of: +--- + xfixes/disconnect.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/xfixes/disconnect.c b/xfixes/disconnect.c +index 28aac45aa..d6da1f970 100644 +--- a/xfixes/disconnect.c ++++ b/xfixes/disconnect.c +@@ -67,6 +67,7 @@ ProcXFixesSetClientDisconnectMode(ClientPtr client) + ClientDisconnectPtr pDisconnect = GetClientDisconnect(client); + + REQUEST(xXFixesSetClientDisconnectModeReq); ++ REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq); + + pDisconnect->disconnect_mode = stuff->disconnect_mode; + +@@ -80,7 +81,7 @@ SProcXFixesSetClientDisconnectMode(ClientPtr client) + + swaps(&stuff->length); + +- REQUEST_AT_LEAST_SIZE(xXFixesSetClientDisconnectModeReq); ++ REQUEST_SIZE_MATCH(xXFixesSetClientDisconnectModeReq); + + swapl(&stuff->disconnect_mode); + +-- +2.49.0 + diff --git a/0005-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch b/0005-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch new file mode 100644 index 0000000000000000000000000000000000000000..4a509fe71abbfaed738cddad0c9b10c1d3441806 --- /dev/null +++ b/0005-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch @@ -0,0 +1,48 @@ +From 756c88df7ac63c6e6d6000e32c897c11821e99cc Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 28 Apr 2025 10:46:03 +0200 +Subject: [PATCH xserver 5/7] os: Account for bytes to ignore when sharing + input buffer + +When reading requests from the clients, the input buffer might be shared +and used between different clients. + +If a given client sends a full request with non-zero bytes to ignore, +the bytes to ignore may still be non-zero even though the request is +full, in which case the buffer could be shared with another client who's +request will not be processed because of those bytes to ignore, leading +to a possible hang of the other client request. + +To avoid the issue, make sure we have zero bytes to ignore left in the +input request when sharing the input buffer with another client. + +CVE-2025-49178 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +(cherry picked from commit d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2) + +Part-of: +--- + os/io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/os/io.c b/os/io.c +index 67465f943..f92a40e0c 100644 +--- a/os/io.c ++++ b/os/io.c +@@ -444,7 +444,7 @@ ReadRequestFromClient(ClientPtr client) + */ + + gotnow -= needed; +- if (!gotnow) ++ if (!gotnow && !oci->ignoreBytes) + AvailableInput = oc; + if (move_header) { + if (client->req_len < bytes_to_int32(sizeof(xBigReq) - sizeof(xReq))) { +-- +2.49.0 + diff --git a/0006-record-Check-for-overflow-in-RecordSanityCheckRegist.patch b/0006-record-Check-for-overflow-in-RecordSanityCheckRegist.patch new file mode 100644 index 0000000000000000000000000000000000000000..4a73bdf93eaf3194a5da84a5bf4b6ad207df8923 --- /dev/null +++ b/0006-record-Check-for-overflow-in-RecordSanityCheckRegist.patch @@ -0,0 +1,64 @@ +From ec2ef0b4e02979b81780ac83652cf2d9e028663f Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 28 Apr 2025 11:47:15 +0200 +Subject: [PATCH xserver 6/7] record: Check for overflow in + RecordSanityCheckRegisterClients() + +The RecordSanityCheckRegisterClients() checks for the request length, +but does not check for integer overflow. + +A client might send a very large value for either the number of clients +or the number of protocol ranges that will cause an integer overflow in +the request length computation, defeating the check for request length. + +To avoid the issue, explicitly check the number of clients against the +limit of clients (which is much lower than an maximum integer value) and +the number of protocol ranges (multiplied by the record length) do not +exceed the maximum integer value. + +This way, we ensure that the final computation for the request length +will not overflow the maximum integer limit. + +CVE-2025-49179 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +(cherry picked from commit 2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4) + +Part-of: +--- + record/record.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/record/record.c b/record/record.c +index e123867a7..018e53f81 100644 +--- a/record/record.c ++++ b/record/record.c +@@ -45,6 +45,7 @@ and Jim Haggerty of Metheus. + #include "inputstr.h" + #include "eventconvert.h" + #include "scrnintstr.h" ++#include "opaque.h" + + #include + #include +@@ -1298,6 +1299,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client, + int i; + XID recordingClient; + ++ /* LimitClients is 2048 at max, way less that MAXINT */ ++ if (stuff->nClients > LimitClients) ++ return BadValue; ++ ++ if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange)) ++ return BadValue; ++ + if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) != + 4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges) + return BadLength; +-- +2.49.0 + diff --git a/0007-randr-Check-for-overflow-in-RRChangeProviderProperty.patch b/0007-randr-Check-for-overflow-in-RRChangeProviderProperty.patch new file mode 100644 index 0000000000000000000000000000000000000000..834eba3e23bc663b6c14e56ff1d522c35165e499 --- /dev/null +++ b/0007-randr-Check-for-overflow-in-RRChangeProviderProperty.patch @@ -0,0 +1,43 @@ +From 81b6d956ed955643f89f6b6bd09d5e8e8df2f1c8 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Tue, 20 May 2025 15:18:19 +0200 +Subject: [PATCH xserver 7/7] randr: Check for overflow in + RRChangeProviderProperty() + +A client might send a request causing an integer overflow when computing +the total size to allocate in RRChangeProviderProperty(). + +To avoid the issue, check that total length in bytes won't exceed the +maximum integer value. + +CVE-2025-49180 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: Peter Hutterer +(cherry picked from commit 3c3a4b767b16174d3213055947ea7f4f88e10ec6) + +Part-of: +--- + randr/rrproviderproperty.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c +index 90c5a9a93..0aa35ad87 100644 +--- a/randr/rrproviderproperty.c ++++ b/randr/rrproviderproperty.c +@@ -179,7 +179,8 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type, + + if (mode == PropModeReplace || len > 0) { + void *new_data = NULL, *old_data = NULL; +- ++ if (total_len > MAXINT / size_in_bytes) ++ return BadValue; + total_size = total_len * size_in_bytes; + new_value.data = (void *) malloc(total_size); + if (!new_value.data && total_size) { +-- +2.49.0 + diff --git a/dist b/dist index 89c1faffc18349bb12eee2371e9dc43bf419b95c..1f9f8c9bbdfdaf483d0bfdf0bf3c48d3cad6b1b9 100644 --- a/dist +++ b/dist @@ -1 +1 @@ -an9 +an9_6 diff --git a/xorg-x11-server-Xwayland.spec b/xorg-x11-server-Xwayland.spec index 3fe21219c094065eea6fbeb1f5c87cd828d1d4db..a15c19ea776351a093c198bef0865247fe12d6b5 100644 --- a/xorg-x11-server-Xwayland.spec +++ b/xorg-x11-server-Xwayland.spec @@ -9,7 +9,7 @@ Summary: Xwayland Name: xorg-x11-server-Xwayland Version: 23.2.7 -Release: 3%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} +Release: 4%{?gitdate:.%{gitdate}git%{shortcommit}}%{?dist} URL: http://www.x.org %if 0%{?gitdate} @@ -41,6 +41,19 @@ Patch11: 0010-sync-Do-not-let-sync-objects-uninitialized.patch Patch12: 0011-sync-Check-values-before-applying-changes.patch Patch13: 0012-sync-Do-not-fail-SyncAddTriggerToSyncObject.patch Patch14: 0013-sync-Apply-changes-last-in-SyncChangeAlarmAttributes.patch +# CVE-2025-49175: Out-of-bounds access in X Rendering extension +Patch15: 0001-render-Avoid-0-or-less-animated-cursors.patch +# CVE-2025-49176: Integer overflow in Big Requests Extension +Patch16: 0002-os-Do-not-overflow-the-integer-size-with-BigRequest.patch +Patch17: 0003-os-Check-for-integer-overflow-on-BigRequest-length.patch +# CVE-2025-49177: Data leak in XFIXES Extension 6 +Patch18: 0004-xfixes-Check-request-length-for-SetClientDisconnectM.patch +# CVE-2025-49178: Unprocessed client request via bytes to ignore +Patch19: 0005-os-Account-for-bytes-to-ignore-when-sharing-input-bu.patch +# CVE-2025-49179: Integer overflow in X Record extension +Patch20: 0006-record-Check-for-overflow-in-RecordSanityCheckRegist.patch +# CVE-2025-49180: Integer overflow in RandR extension +Patch21: 0007-randr-Check-for-overflow-in-RRChangeProviderProperty.patch License: MIT @@ -159,11 +172,16 @@ desktop-file-validate %{buildroot}%{_datadir}/applications/*.desktop %{_libdir}/pkgconfig/xwayland.pc %changelog +* Wed Jun 18 2025 Olivier Fourdan - 23.2.7-4 +- CVE fix for: CVE-2025-49175 (RHEL-97341), CVE-2025-49176 (RHEL-97335), + CVE-2025-49177 (RHEL-97358), CVE-2025-49178 (RHEL-97395), + CVE-2025-49179 (RHEL-97405), CVE-2025-49180 (RHEL-97245) + * Wed Feb 26 2025 Olivier Fourdan - 23.2.7-3 -- CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187), - CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193), - CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202), - CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207) +- CVE fix for: CVE-2025-26594 (RHEL-79126), CVE-2025-26595 (RHEL-79130), + CVE-2025-26596 (RHEL-79134), CVE-2025-26597 (RHEL-79140), + CVE-2025-26598 (RHEL-79141), CVE-2025-26599 (RHEL-79146), + CVE-2025-26600 (RHEL-79154), CVE-2025-26601 (RHEL-79150) * Wed Oct 30 2024 Olivier Fourdan - 23.2.7-2 - Fix for CVE-2024-9632 - (RHEL-61997)