ab104672e1
* gnu/packages/patches/xorg-server-CVE-2017-10971.patch, gnu/packages/patches/xorg-server-CVE-2017-10972.patch: New files. * gnu/local.mk (dist_patch_DATA): Add them. * gnu/packages/xorg.scm (xorg-server)[source]: Use them. Signed-off-by: Leo Famulari <leo@famulari.name>
35 lines
1.1 KiB
Diff
35 lines
1.1 KiB
Diff
From 05442de962d3dc624f79fc1a00eca3ffc5489ced Mon Sep 17 00:00:00 2001
|
|
From: Michal Srb <msrb@suse.com>
|
|
Date: Wed, 24 May 2017 15:54:39 +0300
|
|
Subject: Xi: Zero target buffer in SProcXSendExtensionEvent.
|
|
|
|
Make sure that the xEvent eventT is initialized with zeros, the same way as
|
|
in SProcSendEvent.
|
|
|
|
Some event swapping functions do not overwrite all 32 bytes of xEvent
|
|
structure, for example XSecurityAuthorizationRevoked. Two cooperating
|
|
clients, one swapped and the other not, can send
|
|
XSecurityAuthorizationRevoked event to each other to retrieve old stack data
|
|
from X server. This can be potentialy misused to go around ASLR or
|
|
stack-protector.
|
|
|
|
Signed-off-by: Michal Srb <msrb@suse.com>
|
|
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
|
|
|
diff --git a/Xi/sendexev.c b/Xi/sendexev.c
|
|
index 11d8202..1cf118a 100644
|
|
--- a/Xi/sendexev.c
|
|
+++ b/Xi/sendexev.c
|
|
@@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client)
|
|
{
|
|
CARD32 *p;
|
|
int i;
|
|
- xEvent eventT;
|
|
+ xEvent eventT = { .u.u.type = 0 };
|
|
xEvent *eventP;
|
|
EventSwapPtr proc;
|
|
|
|
--
|
|
cgit v0.10.2
|
|
|