From 1aef5fe5d991ba72f3b3f56cde96880505780648 Mon Sep 17 00:00:00 2001 From: wk333 <13474090681@163.com> Date: Mon, 4 Nov 2024 14:53:53 +0800 Subject: [PATCH] Fix CVE-2024-9632 (cherry picked from commit 0aad729b68578c67031d4fb41be57887dc13cd16) --- backport-CVE-2024-9632.patch | 57 ++++++++++++++++++++++++++++++++++++ xorg-x11-server.spec | 6 +++- 2 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2024-9632.patch diff --git a/backport-CVE-2024-9632.patch b/backport-CVE-2024-9632.patch new file mode 100644 index 0000000..f47803f --- /dev/null +++ b/backport-CVE-2024-9632.patch @@ -0,0 +1,57 @@ +From 85b776571487f52e756f68a069c768757369bfe3 Mon Sep 17 00:00:00 2001 +From: Matthieu Herrb +Date: Thu, 10 Oct 2024 10:37:28 +0200 +Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +origin: https://gitlab.freedesktop.org/xorg/xserver/-/commit/85b776571487f52e756f68a069c768757369bfe3 + +The _XkbSetCompatMap() function attempts to resize the `sym_interpret` +buffer. + +However, It didn't update its size properly. It updated `num_si` only, +without updating `size_si`. + +This may lead to local privilege escalation if the server is run as root +or remote code execution (e.g. x11 over ssh). + +CVE-2024-9632, ZDI-CAN-24756 + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Reviewed-by: Peter Hutterer +Tested-by: Peter Hutterer +Reviewed-by: José Expósito +Part-of: +--- + xkb/xkb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/xkb/xkb.c b/xkb/xkb.c +index 868d7c1e64..aaf9716b36 100644 +--- a/xkb/xkb.c ++++ b/xkb/xkb.c +@@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev, + XkbSymInterpretPtr sym; + unsigned int skipped = 0; + +- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) { +- compat->num_si = req->firstSI + req->nSI; ++ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) { ++ compat->num_si = compat->size_si = req->firstSI + req->nSI; + compat->sym_interpret = reallocarray(compat->sym_interpret, +- compat->num_si, ++ compat->size_si, + sizeof(XkbSymInterpretRec)); + if (!compat->sym_interpret) { +- compat->num_si = 0; ++ compat->num_si = compat->size_si = 0; + return BadAlloc; + } + } +-- +GitLab + diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 309a95c..fbebe45 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -16,7 +16,7 @@ Name: xorg-x11-server Version: 1.20.11 -Release: 33 +Release: 34 Summary: X.Org X11 X server License: MIT and GPLv2 URL: https://www.x.org @@ -128,6 +128,7 @@ Patch6043: backport-dix-fix-valuator-copy-paste-error-in-the-DeviceState.patch Patch6044: backport-0001-CVE-2023-5574.patch Patch6045: backport-0002-CVE-2023-5574.patch Patch6046: backport-0003-CVE-2023-5574.patch +Patch6047: backport-CVE-2024-9632.patch BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc BuildRequires: systemtap-sdt-devel libtool pkgconfig @@ -469,6 +470,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %{_mandir}/man*/* %changelog +* Mon Nov 04 2024 wangkai <13474090681@163.com> - 1.20.11-34 +- Fix CVE-2024-9632 + * Thu Oct 24 2024 lingsheng - 1.20.11-33 - Type:CVE - CVE:CVE-2023-5574 -- Gitee