Re: [Buildroot] [PATCH] package/xserver_xorg-server: security bump to version 21.1.10

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Wed, 27 Dec 2023 17:20:38 +0100
Peter Korsgaard <peter@korsgaard.com> wrote:

> Fixes the following security issues:
> 
> 1) CVE-2023-6377: X.Org server: Out-of-bounds memory write in XKB button actions
> 
> A device has XKB button actions for each button on the device.  When a
> logical device switch happens (e.g.  moving from a touchpad to a mouse), the
> server re-calculates the information available on the respective master
> device (typically the Virtual Core Pointer).  This re-calculation only
> allocated enough memory for a single XKB action rather instead of enough for
> the newly active physical device's number of button.  As a result, querying
> or changing the XKB button actions results in out-of-bounds memory reads and
> writes.
> 
> This may lead to local privilege escalation if the server is run as root or
> remote code execution (e.g. x11 over ssh).
> 
> 2) CVE-2023-6478: X.Org server: Out-of-bounds memory read in
> RRChangeOutputProperty and RRChangeProviderProperty
> 
> This fixes an OOB read and the resulting information disclosure.
> 
> Length calculation for the request was clipped to a 32-bit integer.  With
> the correct stuff->nUnits value the expected request size was truncated,
> passing the REQUEST_FIXED_SIZE check.
> 
> The server then proceeded with reading at least stuff->nUnits bytes
> (depending on stuff->format) from the request and stuffing whatever it finds
> into the property.  In the process it would also allocate at least
> stuff->nUnits bytes, i.e.  4GB.
> 
> See also CVE-2022-46344 where this issue was fixed for other requests.
> 
> For more details, see the advisory:
> https://lists.x.org/archives/xorg-announce/2023-December/003435.html
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
> ---
>  package/x11r7/xserver_xorg-server/xserver_xorg-server.hash | 6 +++---
>  package/x11r7/xserver_xorg-server/xserver_xorg-server.mk   | 2 +-
>  2 files changed, 4 insertions(+), 4 deletions(-)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot