* [OE-core][kirkstone 00/16] Patch review
@ 2022-09-13 14:17 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2022-09-13 14:17 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for kirkstone and have comments back by
end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4220
The following changes since commit bfce90b1260d07f01a8dc2998c9e63ca36d4ebbe:
npm: use npm_registry to cache package (2022-09-06 07:10:59 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alejandro Hernandez Samaniego (1):
rootfs.py: dont try to list installed packages for baremetal images
Alexandre Belloni (2):
ruby: drop capstone support
runqemu: display host uptime when starting
Joshua Watt (1):
oeqa: qemurunner: Report UNIX Epoch timestamp on login
Khem Raj (2):
autoconf: Fix strict prototype errors in generated tests
autoconf: Update K & R stype functions
Kristian Amlie (1):
externalsrc: Don't wipe out src dir when EXPORT_FUNCTIONS is used.
Martin Jansa (1):
libxml2: Port gentest.py to Python-3
Pavel Zhukov (1):
core-image.bbclass: Exclude openssh complementary packages
Peter Bergin (1):
rootfs-postcommands.bbclass: avoid moving ssh host keys if etc is
writable
Peter Kjellerstedt (1):
cairo: Adapt the license information based on what is being built
Richard Purdie (3):
gcc-multilib-config: Fix i686 toolchain relocation issues
kernel: Always set CC and LD for the kernel build
kernel: Use consistent make flags for menuconfig
wangmy (2):
cracklib: upgrade 2.9.7 -> 2.9.8
vala: upgrade 0.56.2 -> 0.56.3
meta/classes/core-image.bbclass | 4 +
meta/classes/externalsrc.bbclass | 8 +-
meta/classes/kernel.bbclass | 16 +-
meta/classes/rootfs-postcommands.bbclass | 30 +-
meta/lib/oe/rootfs.py | 4 +
meta/lib/oeqa/utils/qemurunner.py | 4 +-
.../0001-Port-gentest.py-to-Python-3.patch | 814 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.14.bb | 11 +
...ilers-that-moan-about-K-R-func-decls.patch | 138 +++
.../autoconf/autoconf_2.71.bb | 1 +
.../gcc/gcc-multilib-config.inc | 2 +-
...001-Remove-dependency-on-libcapstone.patch | 36 +
meta/recipes-devtools/ruby/ruby_3.1.2.bb | 2 +-
meta/recipes-devtools/vala/vala_0.56.2.bb | 3 -
meta/recipes-devtools/vala/vala_0.56.3.bb | 3 +
...01-rules-Drop-using-register-keyword.patch | 278 ------
...rrect-parameter-types-to-Debug-calls.patch | 40 -
.../{cracklib_2.9.7.bb => cracklib_2.9.8.bb} | 4 +-
meta/recipes-graphics/cairo/cairo_1.16.0.bb | 6 +-
scripts/runqemu | 6 +
20 files changed, 1058 insertions(+), 352 deletions(-)
create mode 100644 meta/recipes-core/libxml/libxml2/0001-Port-gentest.py-to-Python-3.patch
create mode 100644 meta/recipes-devtools/autoconf/autoconf/0001-Port-to-compilers-that-moan-about-K-R-func-decls.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/0001-Remove-dependency-on-libcapstone.patch
delete mode 100644 meta/recipes-devtools/vala/vala_0.56.2.bb
create mode 100644 meta/recipes-devtools/vala/vala_0.56.3.bb
delete mode 100644 meta/recipes-extended/cracklib/cracklib/0001-rules-Drop-using-register-keyword.patch
delete mode 100644 meta/recipes-extended/cracklib/cracklib/0002-rules-Correct-parameter-types-to-Debug-calls.patch
rename meta/recipes-extended/cracklib/{cracklib_2.9.7.bb => cracklib_2.9.8.bb} (83%)
--
2.25.1
^ permalink raw reply [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 00/16] Patch review
@ 2023-08-17 2:49 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2023-08-17 2:49 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, August 18.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5748
The following changes since commit e1a604db8d2cf8782038b4016cc2e2052467333b:
build-appliance-image: Update to kirkstone head revision (2023-08-07 04:41:22 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Adrian Freihofer (1):
dmidecode: fixup for CVE-2023-30630
Alberto Planas (1):
rpm2cpio.sh: update to the last 4.x version
Alexander Kanavin (1):
libxcrypt: update PV to match SRCREV
Archana Polampalli (2):
ghostscript: fix CVE-2023-38559
qemu: fix CVE-2023-3180
Ashish Sharma (1):
curl: Backport fix CVE-2023-32001
Bruce Ashfield (3):
linux-yocto/5.10: update to v5.10.186
linux-yocto/5.10: update to v5.10.187
linux-yocto/5.10: update to v5.10.188
Marek Vasut (1):
linux-firmware: Fix mediatek mt7601u firmware path
Martin Jansa (1):
npm.bbclass: avoid DeprecationWarning with new python
Narpat Mali (1):
python3-certifi: fix CVE-2023-37920
Pavel Zhukov (1):
scripts/rpm2cpio.sh: Use bzip2 instead of bunzip2
Peter Marko (1):
procps: patch CVE-2023-4016
Vivek Kumbhar (1):
qemu: fix CVE-2023-3354 VNC: improper I/O watch removal in TLS
handshake can lead to remote unauthenticated denial of service
Yogita Urade (1):
qemu: fix CVE-2020-14394
meta/classes/npm.bbclass | 2 +-
...ibxcrypt_4.4.30.bb => libxcrypt_4.4.33.bb} | 0
.../dmidecode/CVE-2023-30630_1a.patch | 236 ++++++++++++++
...-30630_1.patch => CVE-2023-30630_1b.patch} | 126 +++-----
.../dmidecode/CVE-2023-30630_2.patch | 11 +-
.../dmidecode/CVE-2023-30630_3.patch | 60 ++--
.../dmidecode/CVE-2023-30630_4.patch | 149 ++++-----
.../dmidecode/dmidecode_3.3.bb | 3 +-
.../python3-certifi/CVE-2023-37920.patch | 301 ++++++++++++++++++
.../python/python3-certifi_2021.10.8.bb | 4 +-
meta/recipes-devtools/qemu/qemu.inc | 3 +
.../qemu/qemu/CVE-2020-14394.patch | 79 +++++
.../qemu/qemu/CVE-2023-3180.patch | 50 +++
.../qemu/qemu/CVE-2023-3354.patch | 87 +++++
.../ghostscript/CVE-2023-38559.patch | 32 ++
.../ghostscript/ghostscript_9.55.0.bb | 1 +
.../procps/procps/CVE-2023-4016.patch | 85 +++++
meta/recipes-extended/procps/procps_3.3.17.bb | 1 +
.../linux-firmware/linux-firmware_20230515.bb | 2 +-
.../linux/linux-yocto-rt_5.10.bb | 6 +-
.../linux/linux-yocto-tiny_5.10.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.10.bb | 24 +-
.../curl/curl/CVE-2023-32001.patch | 39 +++
meta/recipes-support/curl/curl_7.82.0.bb | 1 +
scripts/rpm2cpio.sh | 30 +-
25 files changed, 1117 insertions(+), 223 deletions(-)
rename meta/recipes-core/libxcrypt/{libxcrypt_4.4.30.bb => libxcrypt_4.4.33.bb} (100%)
create mode 100644 meta/recipes-devtools/dmidecode/dmidecode/CVE-2023-30630_1a.patch
rename meta/recipes-devtools/dmidecode/dmidecode/{CVE-2023-30630_1.patch => CVE-2023-30630_1b.patch} (63%)
create mode 100644 meta/recipes-devtools/python/python3-certifi/CVE-2023-37920.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-14394.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-3180.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-3354.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-38559.patch
create mode 100644 meta/recipes-extended/procps/procps/CVE-2023-4016.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-32001.patch
--
2.34.1
^ permalink raw reply [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 00/16] Patch review
@ 2023-11-22 2:30 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2023-11-22 2:30 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, November 23
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6227
The following changes since commit 4bb6373e5f4a1330a063d1afe855d6c24d5461e7:
python3-jinja2: Fixed ptest result output as per the standard (2023-11-08 04:10:02 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Chaitanya Vadrevu (1):
go: Fix issue in DNS resolver
Deepthi Hemraj (2):
binutils: Fix CVE-2022-47007
binutils: Fix CVE-2022-48064
Lee Chee Yang (1):
ghostscript: ignore GhostPCL CVE-2023-38560
Meenali Gupta (5):
avahi: fix CVE-2023-38471
avahi: fix CVE-2023-38470
avahi: fix CVE-2023-38469
avahi: fix CVE-2023-38472
avahi: fix CVE-2023-38473
Niranjan Pradhan (1):
qemu 6.2.0: Fix CVE-2023-1544
Peter Marko (2):
go: ignore CVE-2023-45283 and CVE-2023-45284
goarch: Move Go architecture mapping to a library
Soumya Sambu (1):
sudo: upgrade 1.9.13p3 -> 1.9.15p2
Vijay Anusuri (1):
tiff: Backport fix for CVE-2023-41175
Wenlin Kang (1):
libxcrypt: fixed some build error for nativesdk with mingw
Yogita Urade (1):
grub: fix CVE-2023-4692
meta/classes/base.bbclass | 2 +-
meta/classes/goarch.bbclass | 27 +----
meta/lib/oe/go.py | 32 ++++++
.../grub/files/CVE-2023-4692.patch | 97 ++++++++++++++++
meta/recipes-bsp/grub/grub2.inc | 1 +
meta/recipes-connectivity/avahi/avahi_0.8.bb | 5 +
.../avahi/files/CVE-2023-38469.patch | 47 ++++++++
.../avahi/files/CVE-2023-38470.patch | 59 ++++++++++
.../avahi/files/CVE-2023-38471.patch | 73 ++++++++++++
.../avahi/files/CVE-2023-38472.patch | 46 ++++++++
.../avahi/files/CVE-2023-38473.patch | 108 ++++++++++++++++++
.../0001-Fix-for-compilation-on-Windows.patch | 37 ++++++
...dom-bytes.c-fixed-conversion-error-w.patch | 47 ++++++++
meta/recipes-core/libxcrypt/libxcrypt.inc | 4 +
.../binutils/binutils-2.38.inc | 2 +
.../binutils/0033-CVE-2022-47007.patch | 34 ++++++
.../binutils/0034-CVE-2022-48064.patch | 57 +++++++++
meta/recipes-devtools/go/go-1.17.13.inc | 5 +-
...Fix-issue-with-DNS-not-being-updated.patch | 51 +++++++++
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2023-1544.patch | 70 ++++++++++++
.../ghostscript/ghostscript_9.55.0.bb | 3 +
...me.c-correctly-include-header-for-ou.patch | 25 ----
meta/recipes-extended/sudo/sudo.inc | 5 +-
.../{sudo_1.9.13p3.bb => sudo_1.9.15p2.bb} | 3 +-
.../libtiff/tiff/CVE-2023-41175.patch | 69 +++++++++++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
27 files changed, 854 insertions(+), 57 deletions(-)
create mode 100644 meta/lib/oe/go.py
create mode 100644 meta/recipes-bsp/grub/files/CVE-2023-4692.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38469.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38470.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38471.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38472.patch
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2023-38473.patch
create mode 100644 meta/recipes-core/libxcrypt/files/0001-Fix-for-compilation-on-Windows.patch
create mode 100644 meta/recipes-core/libxcrypt/files/0001-lib-util-get-random-bytes.c-fixed-conversion-error-w.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0033-CVE-2022-47007.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0034-CVE-2022-48064.patch
create mode 100644 meta/recipes-devtools/go/go-1.20/0010-net-Fix-issue-with-DNS-not-being-updated.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-1544.patch
delete mode 100644 meta/recipes-extended/sudo/files/0001-lib-util-mksigname.c-correctly-include-header-for-ou.patch
rename meta/recipes-extended/sudo/{sudo_1.9.13p3.bb => sudo_1.9.15p2.bb} (92%)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-41175.patch
--
2.34.1
^ permalink raw reply [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 00/16] Patch review
@ 2024-02-27 21:56 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2024-02-27 21:56 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, February 29
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6616
The following changes since commit 5103ce67741782e43612f495bcc851c6509b734b:
runqemu: direct mesa to use its own drivers, rather than ones provided by host distro (2024-02-25 05:51:38 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Adrian Freihofer (8):
oeqa: replace deprecated assertEquals
oeqa/selftest/recipetool: fix for python 3.12
oeqa/selftest/recipetool: expect meson.bb
oeqa/selftest/oelib/buildhistory: git default branch
feature-microblaze-versions.inc: python 3.12 regex
meta/lib/oeqa: python 3.12 regex
meta/recipes: python 3.12 regex
scripts: python 3.12 regex
Bruce Ashfield (2):
kernel: fix localversion in v6.3+
kernel: make LOCALVERSION consistent between recipes
Chris Laplante (1):
recipetool/create_buildsys_python: use importlib instead of imp
Ming Liu (1):
kernel.bbclass: introduce KERNEL_LOCALVERSION
Ross Burton (3):
populate_sdk_ext: use ConfigParser instead of SafeConfigParser
runqemu: add qmp socket support
oeqa/selftest/recipetool: downgrade meson version to not use
pyproject.toml
Trevor Gamblin (1):
scripts/runqemu: fix regex escape sequences
meta/classes/kernel-arch.bbclass | 1 -
meta/classes/kernel.bbclass | 24 +++++++++++-
meta/classes/kernelsrc.bbclass | 1 +
meta/classes/linux-kernel-base.bbclass | 11 ++++++
meta/classes/module-base.bbclass | 1 +
meta/classes/populate_sdk_ext.bbclass | 2 +-
meta/conf/documentation.conf | 1 +
.../feature-microblaze-versions.inc | 2 +-
meta/lib/oeqa/oetest.py | 2 +-
meta/lib/oeqa/sdk/buildtools-cases/sanity.py | 2 +-
meta/lib/oeqa/selftest/cases/bblayers.py | 2 +-
meta/lib/oeqa/selftest/cases/devtool.py | 2 +-
meta/lib/oeqa/selftest/cases/fitimage.py | 6 +--
meta/lib/oeqa/selftest/cases/liboe.py | 2 +-
.../oeqa/selftest/cases/oelib/buildhistory.py | 18 +++++++--
meta/lib/oeqa/selftest/cases/recipetool.py | 19 ++++++----
.../make-mod-scripts/make-mod-scripts_1.0.bb | 3 ++
.../perf/perf/sort-pmuevents.py | 8 ++--
meta/recipes-rt/rt-tests/files/rt_bmark.py | 2 +-
scripts/combo-layer | 2 +-
scripts/contrib/bbvars.py | 6 +--
scripts/contrib/convert-overrides.py | 8 ++--
scripts/lib/checklayer/__init__.py | 4 +-
scripts/lib/recipetool/create.py | 12 +++---
scripts/lib/recipetool/create_buildsys.py | 38 +++++++++----------
.../lib/recipetool/create_buildsys_python.py | 5 +--
scripts/oe-check-sstate | 2 +-
scripts/oe-pkgdata-util | 2 +-
scripts/opkg-query-helper.py | 2 +-
scripts/runqemu | 19 ++++++++--
30 files changed, 134 insertions(+), 75 deletions(-)
--
2.34.1
^ permalink raw reply [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 00/16] Patch review
@ 2024-10-02 13:12 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2024-10-02 13:12 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, October 4
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7370
The following changes since commit ff720f337e40761c7d4d544c963cf518ad5403ad:
lib/oeqa: rename assertRaisesRegexp to assertRaisesRegex (2024-09-21 06:18:58 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Aleksandar Nikolic (3):
install-buildtools: remove md5 checksum validation
install-buildtools: fix "test installation" step
scripts/install-buildtools: Update to 4.0.21
Deepthi Hemraj (3):
gcc: upgrade to v11.5
glibc: stable 2.35 branch updates
bintuils: stable 2.38 branch update
Jinfeng Wang (1):
procps: patch CVE-2023-4016
Martin Jansa (1):
populate_sdk_base: inherit nopackages
Mingli Yu (1):
curl: free old conn better on reuse
Paul Eggleton (1):
install-buildtools: support buildtools-make-tarball and update to 4.1
Peter Marko (4):
gnupg: Document CVE-2022-3219 and mark wontfix
wpa-supplicant: Ignore CVE-2024-5290
wpa-supplicant: Patch CVE-2024-3596
wpa-supplicant: Patch security advisory 2024-2
Purushottam Choudhary (1):
kmscube: Add patch to fix -int-conversion build error
Vijay Anusuri (1):
curl: backport Debian patch for CVE-2024-8096
meta/classes/populate_sdk_base.bbclass | 2 +-
meta/conf/distro/include/maintainers.inc | 2 +-
...valid-Rejected-Groups-element-length.patch | 52 +
...valid-Rejected-Groups-element-length.patch | 50 +
...id-Rejected-Groups-element-in-the-pa.patch | 38 +
.../wpa-supplicant/CVE-2024-3596_00.patch | 82 +
.../wpa-supplicant/CVE-2024-3596_01.patch | 165 +
.../wpa-supplicant/CVE-2024-3596_02.patch | 62 +
.../wpa-supplicant/CVE-2024-3596_03.patch | 37 +
.../wpa-supplicant/CVE-2024-3596_04.patch | 52 +
.../wpa-supplicant/CVE-2024-3596_05.patch | 51 +
.../wpa-supplicant/CVE-2024-3596_06.patch | 46 +
.../wpa-supplicant/CVE-2024-3596_07.patch | 67 +
.../wpa-supplicant/CVE-2024-3596_08.patch | 47 +
.../wpa-supplicant/wpa-supplicant_2.10.bb | 15 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../binutils/binutils-2.38.inc | 2 +-
.../gcc/{gcc-11.4.inc => gcc-11.5.inc} | 8 +-
...ian_11.4.bb => gcc-cross-canadian_11.5.bb} | 0
.../{gcc-cross_11.4.bb => gcc-cross_11.5.bb} | 0
...-crosssdk_11.4.bb => gcc-crosssdk_11.5.bb} | 0
...cc-runtime_11.4.bb => gcc-runtime_11.5.bb} | 0
...itizers_11.4.bb => gcc-sanitizers_11.5.bb} | 0
...{gcc-source_11.4.bb => gcc-source_11.5.bb} | 0
...rch64-Update-Neoverse-N2-core-defini.patch | 38 -
.../gcc/gcc/CVE-2023-4039.patch | 2893 -----------------
.../gcc/{gcc_11.4.bb => gcc_11.5.bb} | 0
...initial_11.4.bb => libgcc-initial_11.5.bb} | 0
.../gcc/{libgcc_11.4.bb => libgcc_11.5.bb} | 0
...ibgfortran_11.4.bb => libgfortran_11.5.bb} | 0
.../procps/procps/CVE-2023-4016-2.patch | 60 +
meta/recipes-extended/procps/procps_3.3.17.bb | 3 +-
...001-common-fix-cast-type-in-init_egl.patch | 34 +
meta/recipes-graphics/kmscube/kmscube_git.bb | 6 +-
...01-url-free-old-conn-better-on-reuse.patch | 95 +
.../curl/curl/CVE-2024-8096.patch | 210 ++
meta/recipes-support/curl/curl_7.82.0.bb | 2 +
meta/recipes-support/gnupg/gnupg_2.3.7.bb | 2 +
scripts/install-buildtools | 63 +-
39 files changed, 1219 insertions(+), 2967 deletions(-)
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0001-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0002-SAE-Check-for-invalid-Rejected-Groups-element-length.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/0003-SAE-Reject-invalid-Rejected-Groups-element-in-the-pa.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_00.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_01.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_02.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_03.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_04.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_05.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_06.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_07.patch
create mode 100644 meta/recipes-connectivity/wpa-supplicant/wpa-supplicant/CVE-2024-3596_08.patch
rename meta/recipes-devtools/gcc/{gcc-11.4.inc => gcc-11.5.inc} (95%)
rename meta/recipes-devtools/gcc/{gcc-cross-canadian_11.4.bb => gcc-cross-canadian_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-cross_11.4.bb => gcc-cross_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-crosssdk_11.4.bb => gcc-crosssdk_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-runtime_11.4.bb => gcc-runtime_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-sanitizers_11.4.bb => gcc-sanitizers_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-source_11.4.bb => gcc-source_11.5.bb} (100%)
delete mode 100644 meta/recipes-devtools/gcc/gcc/0001-aarch64-Update-Neoverse-N2-core-defini.patch
delete mode 100644 meta/recipes-devtools/gcc/gcc/CVE-2023-4039.patch
rename meta/recipes-devtools/gcc/{gcc_11.4.bb => gcc_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc-initial_11.4.bb => libgcc-initial_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc_11.4.bb => libgcc_11.5.bb} (100%)
rename meta/recipes-devtools/gcc/{libgfortran_11.4.bb => libgfortran_11.5.bb} (100%)
create mode 100644 meta/recipes-extended/procps/procps/CVE-2023-4016-2.patch
create mode 100644 meta/recipes-graphics/kmscube/kmscube/0001-common-fix-cast-type-in-init_egl.patch
create mode 100644 meta/recipes-support/curl/curl/0001-url-free-old-conn-better-on-reuse.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-8096.patch
--
2.34.1
^ permalink raw reply [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 00/16] Patch review
@ 2025-01-20 17:50 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-01-20 17:50 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, January 22
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/842
The following changes since commit 8c32d91b64ae296d7832ddeb42983f4f3c237946:
ofono: fix CVE-2024-7547 (2025-01-14 05:49:41 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Aleksandar Nikolic (1):
scripts/install-buildtools: Update to 4.0.23
Alexander Kanavin (1):
rsync: update 3.2.5 -> 3.2.7
Archana Polampalli (6):
rsync: fix CVE-2024-12084
rsync: fix CVE-2024-12085
rsync: fix CVE-2024-12086
rsync: fix CVE-2024-12087
rsync: fix CVE-2024-12088
rsync: fix CVE-2024-12747
Divya Chellam (1):
wget: fix CVE-2024-10524
Khem Raj (1):
rsync: Delete pedantic errors re-ordering patch
Peter Marko (2):
socat: patch CVE-2024-54661
ofono: patch CVE-2024-7540, CVE-2024-7541, CVE-2024-7542
Ross Burton (2):
classes/nativesdk: also override TUNE_PKGARCH
classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package
architecture
Zhang Peng (2):
avahi: fix CVE-2024-52616
vte: fix CVE-2024-37535
meta/classes/nativesdk.bbclass | 1 +
meta/classes/qemu.bbclass | 8 +-
meta/recipes-connectivity/avahi/avahi_0.8.bb | 1 +
.../avahi/files/CVE-2024-52616.patch | 104 +++++++++
...024-7540_CVE-2024-7541_CVE-2024-7542.patch | 52 +++++
meta/recipes-connectivity/ofono/ofono_1.34.bb | 1 +
.../socat/socat/CVE-2024-54661.patch | 113 ++++++++++
.../socat/socat_1.7.4.4.bb | 4 +-
meta/recipes-devtools/gcc/gcc-testsuite.inc | 6 +-
...-prototypes-to-function-declarations.patch | 28 ++-
...antic-errors-at-the-end-of-configure.patch | 68 ------
.../rsync/files/CVE-2024-12084-0001.patch | 156 ++++++++++++++
.../rsync/files/CVE-2024-12084-0002.patch | 43 ++++
.../rsync/files/CVE-2024-12085.patch | 32 +++
.../rsync/files/CVE-2024-12086-0001.patch | 42 ++++
.../rsync/files/CVE-2024-12086-0002.patch | 108 ++++++++++
.../rsync/files/CVE-2024-12086-0003.patch | 108 ++++++++++
.../rsync/files/CVE-2024-12086-0004.patch | 41 ++++
.../rsync/files/CVE-2024-12087-0001.patch | 49 +++++
.../rsync/files/CVE-2024-12087-0002.patch | 31 +++
.../rsync/files/CVE-2024-12087-0003.patch | 40 ++++
.../rsync/files/CVE-2024-12088.patch | 141 +++++++++++++
.../rsync/files/CVE-2024-12747.patch | 192 +++++++++++++++++
.../rsync/{rsync_3.2.5.bb => rsync_3.2.7.bb} | 15 +-
.../wget/wget/CVE-2024-10524.patch | 197 ++++++++++++++++++
meta/recipes-extended/wget/wget_1.21.4.bb | 1 +
.../vte/vte/CVE-2024-37535-0001.patch | 63 ++++++
.../vte/vte/CVE-2024-37535-0002.patch | 85 ++++++++
meta/recipes-support/vte/vte_0.66.2.bb | 9 +-
scripts/install-buildtools | 4 +-
30 files changed, 1645 insertions(+), 98 deletions(-)
create mode 100644 meta/recipes-connectivity/avahi/files/CVE-2024-52616.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7540_CVE-2024-7541_CVE-2024-7542.patch
create mode 100644 meta/recipes-connectivity/socat/socat/CVE-2024-54661.patch
delete mode 100644 meta/recipes-devtools/rsync/files/0001-Turn-on-pedantic-errors-at-the-end-of-configure.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12084-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12085.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0003.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12086-0004.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0001.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0002.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12087-0003.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12088.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2024-12747.patch
rename meta/recipes-devtools/rsync/{rsync_3.2.5.bb => rsync_3.2.7.bb} (81%)
create mode 100644 meta/recipes-extended/wget/wget/CVE-2024-10524.patch
create mode 100644 meta/recipes-support/vte/vte/CVE-2024-37535-0001.patch
create mode 100644 meta/recipes-support/vte/vte/CVE-2024-37535-0002.patch
--
2.43.0
^ permalink raw reply [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 00/16] Patch review
@ 2025-03-05 15:58 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 01/16] libxml2: mark patch as fixing CVE-2025-27113 Steve Sakoman
` (15 more replies)
0 siblings, 16 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, March 7
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1121
The following changes since commit 8ea258ad9c83be5d9548a796f7dda4ac820fc435:
elfutils: Fix multiple CVEs (2025-02-28 07:18:33 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Johannes Kauffmann (1):
mesa: Fix missing GLES3 headers in SDK sysroot
Peter Marko (1):
libxml2: mark patch as fixing CVE-2025-27113
Vijay Anusuri (14):
xwayland: Fix CVE-2024-21885
xwayland: Fix CVE-2024-21886
xwayland: Fix CVE-2024-31080
xwayland: Fix CVE-2024-31081
xwayland: Fix CVE-2024-31083
xwayland: Fix CVE-2024-9632
xwayland: Fix CVE-2025-26594
xwayland: Fix CVE-2025-26595
xwayland: Fix CVE-2025-26596
xwayland: Fix CVE-2025-26597
xwayland: Fix CVE-2025-26598
xwayland: Fix CVE-2025-26599
xwayland: Fix CVE-2025-26600
xwayland: Fix CVE-2025-26601
...-child-axis.patch => CVE-2025-27113.patch} | 1 +
meta/recipes-core/libxml/libxml2_2.9.14.bb | 2 +-
meta/recipes-graphics/mesa/mesa.inc | 5 +
.../xwayland/xwayland/CVE-2024-21885.patch | 113 +++++++++++++++
.../xwayland/xwayland/CVE-2024-21886-1.patch | 74 ++++++++++
.../xwayland/xwayland/CVE-2024-21886-2.patch | 57 ++++++++
.../xwayland/xwayland/CVE-2024-31080.patch | 49 +++++++
.../xwayland/xwayland/CVE-2024-31081.patch | 47 +++++++
.../xwayland/CVE-2024-31083-0001.patch | 118 ++++++++++++++++
.../xwayland/CVE-2024-31083-0002.patch | 77 ++++++++++
.../xwayland/xwayland/CVE-2024-9632.patch | 59 ++++++++
.../xwayland/xwayland/CVE-2025-26594-1.patch | 54 +++++++
.../xwayland/xwayland/CVE-2025-26594-2.patch | 51 +++++++
.../xwayland/xwayland/CVE-2025-26595.patch | 65 +++++++++
.../xwayland/xwayland/CVE-2025-26596.patch | 49 +++++++
.../xwayland/xwayland/CVE-2025-26597.patch | 46 ++++++
.../xwayland/xwayland/CVE-2025-26598.patch | 120 ++++++++++++++++
.../xwayland/xwayland/CVE-2025-26599-1.patch | 66 +++++++++
.../xwayland/xwayland/CVE-2025-26599-2.patch | 129 +++++++++++++++++
.../xwayland/xwayland/CVE-2025-26600.patch | 68 +++++++++
.../xwayland/xwayland/CVE-2025-26601-1.patch | 71 ++++++++++
.../xwayland/xwayland/CVE-2025-26601-2.patch | 85 +++++++++++
.../xwayland/xwayland/CVE-2025-26601-3.patch | 52 +++++++
.../xwayland/xwayland/CVE-2025-26601-4.patch | 132 ++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 21 +++
25 files changed, 1610 insertions(+), 1 deletion(-)
rename meta/recipes-core/libxml/libxml2/{0001-pattern-Fix-compilation-of-explicit-child-axis.patch => CVE-2025-27113.patch} (98%)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-21885.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-2.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31080.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31081.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0001.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0002.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch
--
2.43.0
^ permalink raw reply [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 01/16] libxml2: mark patch as fixing CVE-2025-27113
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 02/16] xwayland: Fix CVE-2024-21885 Steve Sakoman
` (14 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This vulnerability has now a CVE assigned.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
...lation-of-explicit-child-axis.patch => CVE-2025-27113.patch} | 1 +
meta/recipes-core/libxml/libxml2_2.9.14.bb | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
rename meta/recipes-core/libxml/libxml2/{0001-pattern-Fix-compilation-of-explicit-child-axis.patch => CVE-2025-27113.patch} (98%)
diff --git a/meta/recipes-core/libxml/libxml2/0001-pattern-Fix-compilation-of-explicit-child-axis.patch b/meta/recipes-core/libxml/libxml2/CVE-2025-27113.patch
similarity index 98%
rename from meta/recipes-core/libxml/libxml2/0001-pattern-Fix-compilation-of-explicit-child-axis.patch
rename to meta/recipes-core/libxml/libxml2/CVE-2025-27113.patch
index 932c0ec422..92713375eb 100644
--- a/meta/recipes-core/libxml/libxml2/0001-pattern-Fix-compilation-of-explicit-child-axis.patch
+++ b/meta/recipes-core/libxml/libxml2/CVE-2025-27113.patch
@@ -6,6 +6,7 @@ Subject: [PATCH] pattern: Fix compilation of explicit child axis
The child axis is the default axis and should generate XML_OP_ELEM like
the case without an axis.
+CVE: CVE-2025-27113
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/503f788e84f1c1f1d769c2c7258d77faee94b5a3]
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb
index 8f1d882505..1cbd620b34 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.14.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb
@@ -34,7 +34,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar;subdir=${BP};name=testt
file://CVE-2024-25062.patch \
file://CVE-2024-34459.patch \
file://CVE-2022-49043.patch \
- file://0001-pattern-Fix-compilation-of-explicit-child-axis.patch \
+ file://CVE-2025-27113.patch \
file://CVE-2024-56171.patch \
file://CVE-2025-24928.patch \
"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 02/16] xwayland: Fix CVE-2024-21885
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 01/16] libxml2: mark patch as fixing CVE-2025-27113 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 03/16] xwayland: Fix CVE-2024-21886 Steve Sakoman
` (13 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2024-21885.patch | 113 ++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 114 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-21885.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21885.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21885.patch
new file mode 100644
index 0000000000..7c8fbcc3ec
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21885.patch
@@ -0,0 +1,113 @@
+From 4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Thu, 4 Jan 2024 10:01:24 +1000
+Subject: [PATCH] Xi: flush hierarchy events after adding/removing master
+ devices
+
+The `XISendDeviceHierarchyEvent()` function allocates space to store up
+to `MAXDEVICES` (256) `xXIHierarchyInfo` structures in `info`.
+
+If a device with a given ID was removed and a new device with the same
+ID added both in the same operation, the single device ID will lead to
+two info structures being written to `info`.
+
+Since this case can occur for every device ID at once, a total of two
+times `MAXDEVICES` info structures might be written to the allocation.
+
+To avoid it, once one add/remove master is processed, send out the
+device hierarchy event for the current state and continue. That event
+thus only ever has exactly one of either added/removed in it (and
+optionally slave attached/detached).
+
+CVE-2024-21885, ZDI-CAN-22744
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1]
+CVE: CVE-2024-21885
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xi/xichangehierarchy.c | 27 ++++++++++++++++++++++-----
+ 1 file changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
+index d2d985848d..72d00451e3 100644
+--- a/Xi/xichangehierarchy.c
++++ b/Xi/xichangehierarchy.c
+@@ -416,6 +416,11 @@ ProcXIChangeHierarchy(ClientPtr client)
+ size_t len; /* length of data remaining in request */
+ int rc = Success;
+ int flags[MAXDEVICES] = { 0 };
++ enum {
++ NO_CHANGE,
++ FLUSH,
++ CHANGED,
++ } changes = NO_CHANGE;
+
+ REQUEST(xXIChangeHierarchyReq);
+ REQUEST_AT_LEAST_SIZE(xXIChangeHierarchyReq);
+@@ -465,8 +470,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+ rc = add_master(client, c, flags);
+ if (rc != Success)
+ goto unwind;
+- }
++ changes = FLUSH;
+ break;
++ }
+ case XIRemoveMaster:
+ {
+ xXIRemoveMasterInfo *r = (xXIRemoveMasterInfo *) any;
+@@ -475,8 +481,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+ rc = remove_master(client, r, flags);
+ if (rc != Success)
+ goto unwind;
+- }
++ changes = FLUSH;
+ break;
++ }
+ case XIDetachSlave:
+ {
+ xXIDetachSlaveInfo *c = (xXIDetachSlaveInfo *) any;
+@@ -485,8 +492,9 @@ ProcXIChangeHierarchy(ClientPtr client)
+ rc = detach_slave(client, c, flags);
+ if (rc != Success)
+ goto unwind;
+- }
++ changes = CHANGED;
+ break;
++ }
+ case XIAttachSlave:
+ {
+ xXIAttachSlaveInfo *c = (xXIAttachSlaveInfo *) any;
+@@ -495,16 +503,25 @@ ProcXIChangeHierarchy(ClientPtr client)
+ rc = attach_slave(client, c, flags);
+ if (rc != Success)
+ goto unwind;
++ changes = CHANGED;
++ break;
+ }
++ default:
+ break;
+ }
+
++ if (changes == FLUSH) {
++ XISendDeviceHierarchyEvent(flags);
++ memset(flags, 0, sizeof(flags));
++ changes = NO_CHANGE;
++ }
++
+ len -= any->length * 4;
+ any = (xXIAnyHierarchyChangeInfo *) ((char *) any + any->length * 4);
+ }
+
+ unwind:
+-
+- XISendDeviceHierarchyEvent(flags);
++ if (changes != NO_CHANGE)
++ XISendDeviceHierarchyEvent(flags);
+ return rc;
+ }
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index f639088b25..c7e5c7bd81 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -21,6 +21,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-0229-2.patch \
file://CVE-2024-0229-3.patch \
file://CVE-2024-0229-4.patch \
+ file://CVE-2024-21885.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 03/16] xwayland: Fix CVE-2024-21886
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 01/16] libxml2: mark patch as fixing CVE-2025-27113 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 02/16] xwayland: Fix CVE-2024-21885 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 04/16] xwayland: Fix CVE-2024-31080 Steve Sakoman
` (12 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
The patches are copied from xserver-xorg recipe.
CVE reported for both and patches apply on both.
Upstream-Commit:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b
& https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2024-21886-1.patch | 74 +++++++++++++++++++
.../xwayland/xwayland/CVE-2024-21886-2.patch | 57 ++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 2 +
3 files changed, 133 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-2.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-1.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-1.patch
new file mode 100644
index 0000000000..1e1c782963
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-1.patch
@@ -0,0 +1,74 @@
+From bc1fdbe46559dd947674375946bbef54dd0ce36b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= <jexposit@redhat.com>
+Date: Fri, 22 Dec 2023 18:28:31 +0100
+Subject: [PATCH] Xi: do not keep linked list pointer during recursion
+
+The `DisableDevice()` function is called whenever an enabled device
+is disabled and it moves the device from the `inputInfo.devices` linked
+list to the `inputInfo.off_devices` linked list.
+
+However, its link/unlink operation has an issue during the recursive
+call to `DisableDevice()` due to the `prev` pointer pointing to a
+removed device.
+
+This issue leads to a length mismatch between the total number of
+devices and the number of device in the list, leading to a heap
+overflow and, possibly, to local privilege escalation.
+
+Simplify the code that checked whether the device passed to
+`DisableDevice()` was in `inputInfo.devices` or not and find the
+previous device after the recursion.
+
+CVE-2024-21886, ZDI-CAN-22840
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b]
+CVE: CVE-2024-21886
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/devices.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index dca98c8d1b..389d28a23c 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -453,14 +453,20 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+ {
+ DeviceIntPtr *prev, other;
+ BOOL enabled;
++ BOOL dev_in_devices_list = FALSE;
+ int flags[MAXDEVICES] = { 0 };
+
+ if (!dev->enabled)
+ return TRUE;
+
+- for (prev = &inputInfo.devices;
+- *prev && (*prev != dev); prev = &(*prev)->next);
+- if (*prev != dev)
++ for (other = inputInfo.devices; other; other = other->next) {
++ if (other == dev) {
++ dev_in_devices_list = TRUE;
++ break;
++ }
++ }
++
++ if (!dev_in_devices_list)
+ return FALSE;
+
+ TouchEndPhysicallyActiveTouches(dev);
+@@ -511,6 +517,9 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+ LeaveWindow(dev);
+ SetFocusOut(dev);
+
++ for (prev = &inputInfo.devices;
++ *prev && (*prev != dev); prev = &(*prev)->next);
++
+ *prev = dev->next;
+ dev->next = inputInfo.off_devices;
+ inputInfo.off_devices = dev;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-2.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-2.patch
new file mode 100644
index 0000000000..af607df4f0
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-21886-2.patch
@@ -0,0 +1,57 @@
+From 26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Fri, 5 Jan 2024 09:40:27 +1000
+Subject: [PATCH] dix: when disabling a master, float disabled slaved devices
+ too
+
+Disabling a master device floats all slave devices but we didn't do this
+to already-disabled slave devices. As a result those devices kept their
+reference to the master device resulting in access to already freed
+memory if the master device was removed before the corresponding slave
+device.
+
+And to match this behavior, also forcibly reset that pointer during
+CloseDownDevices().
+
+Related to CVE-2024-21886, ZDI-CAN-22840
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8]
+CVE: CVE-2024-21886
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/devices.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index 389d28a23c..84a6406d13 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -483,6 +483,13 @@ DisableDevice(DeviceIntPtr dev, BOOL sendevent)
+ flags[other->id] |= XISlaveDetached;
+ }
+ }
++
++ for (other = inputInfo.off_devices; other; other = other->next) {
++ if (!IsMaster(other) && GetMaster(other, MASTER_ATTACHED) == dev) {
++ AttachDevice(NULL, other, NULL);
++ flags[other->id] |= XISlaveDetached;
++ }
++ }
+ }
+ else {
+ for (other = inputInfo.devices; other; other = other->next) {
+@@ -1088,6 +1095,11 @@ CloseDownDevices(void)
+ dev->master = NULL;
+ }
+
++ for (dev = inputInfo.off_devices; dev; dev = dev->next) {
++ if (!IsMaster(dev) && !IsFloating(dev))
++ dev->master = NULL;
++ }
++
+ CloseDeviceList(&inputInfo.devices);
+ CloseDeviceList(&inputInfo.off_devices);
+
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index c7e5c7bd81..1d4e699d94 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -22,6 +22,8 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-0229-3.patch \
file://CVE-2024-0229-4.patch \
file://CVE-2024-21885.patch \
+ file://CVE-2024-21886-1.patch \
+ file://CVE-2024-21886-2.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 04/16] xwayland: Fix CVE-2024-31080
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 03/16] xwayland: Fix CVE-2024-21886 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 05/16] xwayland: Fix CVE-2024-31081 Steve Sakoman
` (11 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/96798fc1967491c80a4d0c8d9e0a80586cb2152b
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2024-31080.patch | 49 +++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31080.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31080.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31080.patch
new file mode 100644
index 0000000000..40296903cd
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31080.patch
@@ -0,0 +1,49 @@
+From 96798fc1967491c80a4d0c8d9e0a80586cb2152b Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 22 Mar 2024 18:51:45 -0700
+Subject: [PATCH] Xi: ProcXIGetSelectedEvents needs to use unswapped length to
+ send reply
+
+CVE-2024-31080
+
+Reported-by: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=69762
+Fixes: 53e821ab4 ("Xi: add request processing for XIGetSelectedEvents.")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/96798fc1967491c80a4d0c8d9e0a80586cb2152b]
+CVE: CVE-2024-31080
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xi/xiselectev.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Xi/xiselectev.c b/Xi/xiselectev.c
+index edcb8a0d36..ac14949871 100644
+--- a/Xi/xiselectev.c
++++ b/Xi/xiselectev.c
+@@ -349,6 +349,7 @@ ProcXIGetSelectedEvents(ClientPtr client)
+ InputClientsPtr others = NULL;
+ xXIEventMask *evmask = NULL;
+ DeviceIntPtr dev;
++ uint32_t length;
+
+ REQUEST(xXIGetSelectedEventsReq);
+ REQUEST_SIZE_MATCH(xXIGetSelectedEventsReq);
+@@ -418,10 +419,12 @@ ProcXIGetSelectedEvents(ClientPtr client)
+ }
+ }
+
++ /* save the value before SRepXIGetSelectedEvents swaps it */
++ length = reply.length;
+ WriteReplyToClient(client, sizeof(xXIGetSelectedEventsReply), &reply);
+
+ if (reply.num_masks)
+- WriteToClient(client, reply.length * 4, buffer);
++ WriteToClient(client, length * 4, buffer);
+
+ free(buffer);
+ return Success;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 1d4e699d94..78e849b305 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -24,6 +24,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-21885.patch \
file://CVE-2024-21886-1.patch \
file://CVE-2024-21886-2.patch \
+ file://CVE-2024-31080.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 05/16] xwayland: Fix CVE-2024-31081
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 04/16] xwayland: Fix CVE-2024-31080 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 06/16] xwayland: Fix CVE-2024-31083 Steve Sakoman
` (10 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3e77295f888c67fc7645db5d0c00926a29ffecee
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2024-31081.patch | 47 +++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31081.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31081.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31081.patch
new file mode 100644
index 0000000000..4380004700
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31081.patch
@@ -0,0 +1,47 @@
+From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001
+From: Alan Coopersmith <alan.coopersmith@oracle.com>
+Date: Fri, 22 Mar 2024 18:56:27 -0700
+Subject: [PATCH] Xi: ProcXIPassiveGrabDevice needs to use unswapped length to
+ send reply
+
+CVE-2024-31081
+
+Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.")
+Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/3e77295f888c67fc7645db5d0c00926a29ffecee]
+CVE: CVE-2024-31081
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xi/xipassivegrab.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
+index c9ac2f8553..896233bec2 100644
+--- a/Xi/xipassivegrab.c
++++ b/Xi/xipassivegrab.c
+@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+ GrabParameters param;
+ void *tmp;
+ int mask_len;
++ uint32_t length;
+
+ REQUEST(xXIPassiveGrabDeviceReq);
+ REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
+@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client)
+ }
+ }
+
++ /* save the value before SRepXIPassiveGrabDevice swaps it */
++ length = rep.length;
+ WriteReplyToClient(client, sizeof(rep), &rep);
+ if (rep.num_modifiers)
+- WriteToClient(client, rep.length * 4, modifiers_failed);
++ WriteToClient(client, length * 4, modifiers_failed);
+
+ out:
+ free(modifiers_failed);
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 78e849b305..5fa2402234 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -25,6 +25,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-21886-1.patch \
file://CVE-2024-21886-2.patch \
file://CVE-2024-31080.patch \
+ file://CVE-2024-31081.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 06/16] xwayland: Fix CVE-2024-31083
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 05/16] xwayland: Fix CVE-2024-31081 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 07/16] xwayland: Fix CVE-2024-9632 Steve Sakoman
` (9 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
The patches are copied from xserver-xorg recipe.
CVE reported for both and patches apply on both.
Upstream-Commit:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdca6c3d1f5057ee & https://gitlab.freedesktop.org/xorg/xserver/-/commit/337d8d48b618d4fc
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/CVE-2024-31083-0001.patch | 118 ++++++++++++++++++
.../xwayland/CVE-2024-31083-0002.patch | 77 ++++++++++++
.../xwayland/xwayland_22.1.8.bb | 2 +
3 files changed, 197 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0001.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0002.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0001.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0001.patch
new file mode 100644
index 0000000000..754e03961a
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0001.patch
@@ -0,0 +1,118 @@
+From bdca6c3d1f5057eeb31609b1280fc93237b00c77 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Tue, 30 Jan 2024 13:13:35 +1000
+Subject: [PATCH] render: fix refcounting of glyphs during ProcRenderAddGlyphs
+
+Previously, AllocateGlyph would return a new glyph with refcount=0 and a
+re-used glyph would end up not changing the refcount at all. The
+resulting glyph_new array would thus have multiple entries pointing to
+the same non-refcounted glyphs.
+
+AddGlyph may free a glyph, resulting in a UAF when the same glyph
+pointer is then later used.
+
+Fix this by returning a refcount of 1 for a new glyph and always
+incrementing the refcount for a re-used glyph, followed by dropping that
+refcount back down again when we're done with it.
+
+CVE-2024-31083, ZDI-CAN-22880
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
+
+CVE: CVE-2024-31083
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdca6c3d1f5057ee]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ render/glyph.c | 5 +++--
+ render/glyphstr.h | 2 ++
+ render/render.c | 15 +++++++++++----
+ 3 files changed, 16 insertions(+), 6 deletions(-)
+
+diff --git a/render/glyph.c b/render/glyph.c
+index f3ed9cf..d5fc5f3 100644
+--- a/render/glyph.c
++++ b/render/glyph.c
+@@ -245,10 +245,11 @@ FreeGlyphPicture(GlyphPtr glyph)
+ }
+ }
+
+-static void
++void
+ FreeGlyph(GlyphPtr glyph, int format)
+ {
+ CheckDuplicates(&globalGlyphs[format], "FreeGlyph");
++ BUG_RETURN(glyph->refcnt == 0);
+ if (--glyph->refcnt == 0) {
+ GlyphRefPtr gr;
+ int i;
+@@ -354,7 +355,7 @@ AllocateGlyph(xGlyphInfo * gi, int fdepth)
+ glyph = (GlyphPtr) malloc(size);
+ if (!glyph)
+ return 0;
+- glyph->refcnt = 0;
++ glyph->refcnt = 1;
+ glyph->size = size + sizeof(xGlyphInfo);
+ glyph->info = *gi;
+ dixInitPrivates(glyph, (char *) glyph + head_size, PRIVATE_GLYPH);
+diff --git a/render/glyphstr.h b/render/glyphstr.h
+index 2f51bd2..68f8c9e 100644
+--- a/render/glyphstr.h
++++ b/render/glyphstr.h
+@@ -117,6 +117,8 @@ extern GlyphSetPtr AllocateGlyphSet(int fdepth, PictFormatPtr format);
+ extern int
+ FreeGlyphSet(void *value, XID gid);
+
++void FreeGlyph(GlyphPtr glyph, int format);
++
+ #define GLYPH_HAS_GLYPH_PICTURE_ACCESSOR 1 /* used for api compat */
+ extern _X_EXPORT PicturePtr
+ GetGlyphPicture(GlyphPtr glyph, ScreenPtr pScreen);
+diff --git a/render/render.c b/render/render.c
+index 456f156..5bc2a20 100644
+--- a/render/render.c
++++ b/render/render.c
+@@ -1076,6 +1076,7 @@ ProcRenderAddGlyphs(ClientPtr client)
+
+ if (glyph_new->glyph && glyph_new->glyph != DeletedGlyph) {
+ glyph_new->found = TRUE;
++ ++glyph_new->glyph->refcnt;
+ }
+ else {
+ GlyphPtr glyph;
+@@ -1168,8 +1169,10 @@ ProcRenderAddGlyphs(ClientPtr client)
+ err = BadAlloc;
+ goto bail;
+ }
+- for (i = 0; i < nglyphs; i++)
++ for (i = 0; i < nglyphs; i++) {
+ AddGlyph(glyphSet, glyphs[i].glyph, glyphs[i].id);
++ FreeGlyph(glyphs[i].glyph, glyphSet->fdepth);
++ }
+
+ if (glyphsBase != glyphsLocal)
+ free(glyphsBase);
+@@ -1179,9 +1182,13 @@ ProcRenderAddGlyphs(ClientPtr client)
+ FreePicture((void *) pSrc, 0);
+ if (pSrcPix)
+ FreeScratchPixmapHeader(pSrcPix);
+- for (i = 0; i < nglyphs; i++)
+- if (glyphs[i].glyph && !glyphs[i].found)
+- free(glyphs[i].glyph);
++ for (i = 0; i < nglyphs; i++) {
++ if (glyphs[i].glyph) {
++ --glyphs[i].glyph->refcnt;
++ if (!glyphs[i].found)
++ free(glyphs[i].glyph);
++ }
++ }
+ if (glyphsBase != glyphsLocal)
+ free(glyphsBase);
+ return err;
+--
+2.40.0
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0002.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0002.patch
new file mode 100644
index 0000000000..c597e9b575
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-31083-0002.patch
@@ -0,0 +1,77 @@
+From 337d8d48b618d4fc0168a7b978be4c3447650b04 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Fri, 5 Apr 2024 15:24:49 +0200
+Subject: [PATCH] render: Avoid possible double-free in ProcRenderAddGlyphs()
+ ProcRenderAddGlyphs() adds the glyph to the glyphset using AddGlyph() and
+ then frees it using FreeGlyph() to decrease the reference count, after
+ AddGlyph() has increased it.
+
+AddGlyph() however may chose to reuse an existing glyph if it's already
+in the glyphSet, and free the glyph that was given, in which case the
+caller function, ProcRenderAddGlyphs() will call FreeGlyph() on an
+already freed glyph, as reported by ASan:
+
+ READ of size 4 thread T0
+ #0 in FreeGlyph xserver/render/glyph.c:252
+ #1 in ProcRenderAddGlyphs xserver/render/render.c:1174
+ #2 in Dispatch xserver/dix/dispatch.c:546
+ #3 in dix_main xserver/dix/main.c:271
+ #4 in main xserver/dix/stubmain.c:34
+ #5 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+ #6 in __libc_start_main_impl ../csu/libc-start.c:360
+ #7 (/usr/bin/Xwayland+0x44fe4)
+ Address is located 0 bytes inside of 64-byte region
+ freed by thread T0 here:
+ #0 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
+ #1 in _dixFreeObjectWithPrivates xserver/dix/privates.c:538
+ #2 in AddGlyph xserver/render/glyph.c:295
+ #3 in ProcRenderAddGlyphs xserver/render/render.c:1173
+ #4 in Dispatch xserver/dix/dispatch.c:546
+ #5 in dix_main xserver/dix/main.c:271
+ #6 in main xserver/dix/stubmain.c:34
+ #7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+ previously allocated by thread T0 here:
+ #0 in __interceptor_malloc libsanitizer/asan/asan_malloc_linux.cpp:69
+ #1 in AllocateGlyph xserver/render/glyph.c:355
+ #2 in ProcRenderAddGlyphs xserver/render/render.c:1085
+ #3 in Dispatch xserver/dix/dispatch.c:546
+ #4 in dix_main xserver/dix/main.c:271
+ #5 in main xserver/dix/stubmain.c:34
+ #6 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
+ SUMMARY: AddressSanitizer: heap-use-after-free xserver/render/glyph.c:252 in FreeGlyph
+
+To avoid that, make sure not to free the given glyph in AddGlyph().
+
+v2: Simplify the test using the boolean returned from AddGlyph() (Michel)
+v3: Simplify even more by not freeing the glyph in AddGlyph() (Peter)
+
+Fixes: bdca6c3d1 - render: fix refcounting of glyphs during ProcRenderAddGlyphs
+Closes: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1659
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1476>
+
+CVE: CVE-2024-31083
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/337d8d48b618d4fc]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ render/glyph.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/render/glyph.c b/render/glyph.c
+index d5fc5f3..f5069d4 100644
+--- a/render/glyph.c
++++ b/render/glyph.c
+@@ -291,8 +291,6 @@ AddGlyph(GlyphSetPtr glyphSet, GlyphPtr glyph, Glyph id)
+ gr = FindGlyphRef(&globalGlyphs[glyphSet->fdepth], signature,
+ TRUE, glyph->sha1);
+ if (gr->glyph && gr->glyph != DeletedGlyph && gr->glyph != glyph) {
+- FreeGlyphPicture(glyph);
+- dixFreeObjectWithPrivates(glyph, PRIVATE_GLYPH);
+ glyph = gr->glyph;
+ }
+ else if (gr->glyph != glyph) {
+--
+2.40.0
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 5fa2402234..258a875697 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -26,6 +26,8 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-21886-2.patch \
file://CVE-2024-31080.patch \
file://CVE-2024-31081.patch \
+ file://CVE-2024-31083-0001.patch \
+ file://CVE-2024-31083-0002.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 07/16] xwayland: Fix CVE-2024-9632
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 06/16] xwayland: Fix CVE-2024-31083 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 08/16] xwayland: Fix CVE-2025-26594 Steve Sakoman
` (8 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ba1d14f8eff2a123bd7ff4d48c02e1d5131358e0
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2024-9632.patch | 59 +++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 60 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch
new file mode 100644
index 0000000000..54888f6347
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2024-9632.patch
@@ -0,0 +1,59 @@
+From ba1d14f8eff2a123bd7ff4d48c02e1d5131358e0 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Thu, 10 Oct 2024 10:37:28 +0200
+Subject: [PATCH] xkb: Fix buffer overflow in _XkbSetCompatMap()
+
+The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
+buffer.
+
+However, It didn't update its size properly. It updated `num_si` only,
+without updating `size_si`.
+
+This may lead to local privilege escalation if the server is run as root
+or remote code execution (e.g. x11 over ssh).
+
+CVE-2024-9632, ZDI-CAN-24756
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: José Expósito <jexposit@redhat.com>
+(cherry picked from commit 85b77657)
+
+Part-of: <!1734>
+
+CVE: CVE-2024-9632
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/ba1d14f8eff2a123bd7ff4d48c02e1d5131358e0]
+
+Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 276dc19..7da00a0 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -2992,13 +2992,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
+ XkbSymInterpretPtr sym;
+ unsigned int skipped = 0;
+
+- if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) {
+- compat->num_si = req->firstSI + req->nSI;
++ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
++ compat->num_si = compat->size_si = req->firstSI + req->nSI;
+ compat->sym_interpret = reallocarray(compat->sym_interpret,
+- compat->num_si,
++ compat->size_si,
+ sizeof(XkbSymInterpretRec));
+ if (!compat->sym_interpret) {
+- compat->num_si = 0;
++ compat->num_si = compat->size_si = 0;
+ return BadAlloc;
+ }
+ }
+--
+2.40.0
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 258a875697..23575b387e 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -28,6 +28,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-31081.patch \
file://CVE-2024-31083-0001.patch \
file://CVE-2024-31083-0002.patch \
+ file://CVE-2024-9632.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 08/16] xwayland: Fix CVE-2025-26594
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 07/16] xwayland: Fix CVE-2024-9632 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 09/16] xwayland: Fix CVE-2025-26595 Steve Sakoman
` (7 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
The patches are copied from xserver-xorg recipe.
CVE reported for both and patches apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26594-1.patch | 54 +++++++++++++++++++
.../xwayland/xwayland/CVE-2025-26594-2.patch | 51 ++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 2 +
3 files changed, 107 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch
new file mode 100644
index 0000000000..f34a89e6ea
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-1.patch
@@ -0,0 +1,54 @@
+From 01642f263f12becf803b19be4db95a4a83f94acc Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 27 Nov 2024 11:27:05 +0100
+Subject: [PATCH] Cursor: Refuse to free the root cursor
+
+If a cursor reference count drops to 0, the cursor is freed.
+
+The root cursor however is referenced with a specific global variable,
+and when the root cursor is freed, the global variable may still point
+to freed memory.
+
+Make sure to prevent the rootCursor from being explicitly freed by a
+client.
+
+CVE-2025-26594, ZDI-CAN-25544
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+v2: Explicitly forbid XFreeCursor() on the root cursor (Peter Hutterer
+<peter.hutterer@who-t.net>)
+v3: Return BadCursor instead of BadValue (Michel Danzer
+<michel@daenzer.net>)
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Suggested-by: Peter Hutterer <peter.hutterer@who-t.net>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26]
+CVE: CVE-2025-26594
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/dispatch.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dix/dispatch.c b/dix/dispatch.c
+index 4602961..30b95c1 100644
+--- a/dix/dispatch.c
++++ b/dix/dispatch.c
+@@ -3107,6 +3107,10 @@ ProcFreeCursor(ClientPtr client)
+ rc = dixLookupResourceByType((void **) &pCursor, stuff->id, RT_CURSOR,
+ client, DixDestroyAccess);
+ if (rc == Success) {
++ if (pCursor == rootCursor) {
++ client->errorValue = stuff->id;
++ return BadCursor;
++ }
+ FreeResource(stuff->id, RT_NONE);
+ return Success;
+ }
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch
new file mode 100644
index 0000000000..6ebf540ab9
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26594-2.patch
@@ -0,0 +1,51 @@
+From b0a09ba6020147961acc62d9c73d807b4cccd9f7 Mon Sep 17 00:00:00 2001
+From: Peter Hutterer <peter.hutterer@who-t.net>
+Date: Wed, 4 Dec 2024 15:49:43 +1000
+Subject: [PATCH] dix: keep a ref to the rootCursor
+
+CreateCursor returns a cursor with refcount 1 - that refcount is used by
+the resource system, any caller needs to call RefCursor to get their own
+reference. That happens correctly for normal cursors but for our
+rootCursor we keep a variable to the cursor despite not having a ref for
+ourselves.
+
+Fix this by reffing/unreffing the rootCursor to ensure our pointer is
+valid.
+
+Related to CVE-2025-26594, ZDI-CAN-25544
+
+Reviewed-by: Olivier Fourdan <ofourdan@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6]
+CVE: CVE-2025-26594
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/dix/main.c b/dix/main.c
+index bfc8add..38e29ce 100644
+--- a/dix/main.c
++++ b/dix/main.c
+@@ -231,6 +231,8 @@ dix_main(int argc, char *argv[], char *envp[])
+ FatalError("could not open default cursor font");
+ }
+
++ rootCursor = RefCursor(rootCursor);
++
+ #ifdef PANORAMIX
+ /*
+ * Consolidate window and colourmap information for each screen
+@@ -271,6 +273,8 @@ dix_main(int argc, char *argv[], char *envp[])
+
+ Dispatch();
+
++ UnrefCursor(rootCursor);
++
+ UndisplayDevices();
+ DisableAllDevices();
+
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 23575b387e..814fc1ce40 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -29,6 +29,8 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-31083-0001.patch \
file://CVE-2024-31083-0002.patch \
file://CVE-2024-9632.patch \
+ file://CVE-2025-26594-1.patch \
+ file://CVE-2025-26594-2.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 09/16] xwayland: Fix CVE-2025-26595
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 08/16] xwayland: Fix CVE-2025-26594 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 10/16] xwayland: Fix CVE-2025-26596 Steve Sakoman
` (6 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26595.patch | 65 +++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 66 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch
new file mode 100644
index 0000000000..a7478d9e2a
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26595.patch
@@ -0,0 +1,65 @@
+From 11fcda8753e994e15eb915d28cf487660ec8e722 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 27 Nov 2024 14:41:45 +0100
+Subject: [PATCH] xkb: Fix buffer overflow in XkbVModMaskText()
+
+The code in XkbVModMaskText() allocates a fixed sized buffer on the
+stack and copies the virtual mod name.
+
+There's actually two issues in the code that can lead to a buffer
+overflow.
+
+First, the bound check mixes pointers and integers using misplaced
+parenthesis, defeating the bound check.
+
+But even though, if the check fails, the data is still copied, so the
+stack overflow will occur regardless.
+
+Change the logic to skip the copy entirely if the bound check fails.
+
+CVE-2025-26595, ZDI-CAN-25545
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87]
+CVE: CVE-2025-26595
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkbtext.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/xkb/xkbtext.c b/xkb/xkbtext.c
+index 0184664207..93262528bb 100644
+--- a/xkb/xkbtext.c
++++ b/xkb/xkbtext.c
+@@ -173,14 +173,14 @@ XkbVModMaskText(XkbDescPtr xkb,
+ len = strlen(tmp) + 1 + (str == buf ? 0 : 1);
+ if (format == XkbCFile)
+ len += 4;
+- if ((str - (buf + len)) <= VMOD_BUFFER_SIZE) {
+- if (str != buf) {
+- if (format == XkbCFile)
+- *str++ = '|';
+- else
+- *str++ = '+';
+- len--;
+- }
++ if ((str - buf) + len > VMOD_BUFFER_SIZE)
++ continue; /* Skip */
++ if (str != buf) {
++ if (format == XkbCFile)
++ *str++ = '|';
++ else
++ *str++ = '+';
++ len--;
+ }
+ if (format == XkbCFile)
+ sprintf(str, "%sMask", tmp);
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 814fc1ce40..452bae8c8d 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -31,6 +31,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2024-9632.patch \
file://CVE-2025-26594-1.patch \
file://CVE-2025-26594-2.patch \
+ file://CVE-2025-26595.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 10/16] xwayland: Fix CVE-2025-26596
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 09/16] xwayland: Fix CVE-2025-26595 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 11/16] xwayland: Fix CVE-2025-26597 Steve Sakoman
` (5 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26596.patch | 49 +++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch
new file mode 100644
index 0000000000..f9df8d75ea
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26596.patch
@@ -0,0 +1,49 @@
+From 80d69f01423fc065c950e1ff4e8ddf9f675df773 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 28 Nov 2024 11:49:34 +0100
+Subject: [PATCH] xkb: Fix computation of XkbSizeKeySyms
+
+The computation of the length in XkbSizeKeySyms() differs from what is
+actually written in XkbWriteKeySyms(), leading to a heap overflow.
+
+Fix the calculation in XkbSizeKeySyms() to match what kbWriteKeySyms()
+does.
+
+CVE-2025-26596, ZDI-CAN-25543
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01]
+CVE: CVE-2025-26596
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkb.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 85659382da..744dba63d7 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -1095,10 +1095,10 @@ XkbSizeKeySyms(XkbDescPtr xkb, xkbGetMapReply * rep)
+ len = rep->nKeySyms * SIZEOF(xkbSymMapWireDesc);
+ symMap = &xkb->map->key_sym_map[rep->firstKeySym];
+ for (i = nSyms = 0; i < rep->nKeySyms; i++, symMap++) {
+- if (symMap->offset != 0) {
+- nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
+- nSyms += nSymsThisKey;
+- }
++ nSymsThisKey = XkbNumGroups(symMap->group_info) * symMap->width;
++ if (nSymsThisKey == 0)
++ continue;
++ nSyms += nSymsThisKey;
+ }
+ len += nSyms * 4;
+ rep->totalSyms = nSyms;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 452bae8c8d..18fe2dbc98 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -32,6 +32,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26594-1.patch \
file://CVE-2025-26594-2.patch \
file://CVE-2025-26595.patch \
+ file://CVE-2025-26596.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 11/16] xwayland: Fix CVE-2025-26597
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (9 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 10/16] xwayland: Fix CVE-2025-26596 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 12/16] xwayland: Fix CVE-2025-26598 Steve Sakoman
` (4 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26597.patch | 46 +++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 47 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch
new file mode 100644
index 0000000000..b0735d0b46
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26597.patch
@@ -0,0 +1,46 @@
+From 0e4ed94952b255c04fe910f6a1d9c852878dcd64 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Thu, 28 Nov 2024 14:09:04 +0100
+Subject: [PATCH] xkb: Fix buffer overflow in XkbChangeTypesOfKey()
+
+If XkbChangeTypesOfKey() is called with nGroups == 0, it will resize the
+key syms to 0 but leave the key actions unchanged.
+
+If later, the same function is called with a non-zero value for nGroups,
+this will cause a buffer overflow because the key actions are of the wrong
+size.
+
+To avoid the issue, make sure to resize both the key syms and key actions
+when nGroups is 0.
+
+CVE-2025-26597, ZDI-CAN-25683
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949]
+CVE: CVE-2025-26597
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/XKBMisc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/xkb/XKBMisc.c b/xkb/XKBMisc.c
+index abbfed90eb..fd180fad2c 100644
+--- a/xkb/XKBMisc.c
++++ b/xkb/XKBMisc.c
+@@ -553,6 +553,7 @@ XkbChangeTypesOfKey(XkbDescPtr xkb,
+ i = XkbSetNumGroups(i, 0);
+ xkb->map->key_sym_map[key].group_info = i;
+ XkbResizeKeySyms(xkb, key, 0);
++ XkbResizeKeyActions(xkb, key, 0);
+ return Success;
+ }
+
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 18fe2dbc98..0303e39de4 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -33,6 +33,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26594-2.patch \
file://CVE-2025-26595.patch \
file://CVE-2025-26596.patch \
+ file://CVE-2025-26597.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 12/16] xwayland: Fix CVE-2025-26598
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (10 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 11/16] xwayland: Fix CVE-2025-26597 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 13/16] xwayland: Fix CVE-2025-26599 Steve Sakoman
` (3 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26598.patch | 120 ++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 121 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch
new file mode 100644
index 0000000000..210a76262a
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26598.patch
@@ -0,0 +1,120 @@
+From bba9df1a9d57234c76c0b93f88dacb143d01bca2 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 16 Dec 2024 11:25:11 +0100
+Subject: [PATCH] Xi: Fix barrier device search
+
+The function GetBarrierDevice() would search for the pointer device
+based on its device id and return the matching value, or supposedly NULL
+if no match was found.
+
+Unfortunately, as written, it would return the last element of the list
+if no matching device id was found which can lead to out of bounds
+memory access.
+
+Fix the search function to return NULL if not matching device is found,
+and adjust the callers to handle the case where the device cannot be
+found.
+
+CVE-2025-26598, ZDI-CAN-25740
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a]
+CVE: CVE-2025-26598
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xi/xibarriers.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/Xi/xibarriers.c b/Xi/xibarriers.c
+index 700b2b8c53..6761bcb49a 100644
+--- a/Xi/xibarriers.c
++++ b/Xi/xibarriers.c
+@@ -132,14 +132,15 @@ static void FreePointerBarrierClient(struct PointerBarrierClient *c)
+
+ static struct PointerBarrierDevice *GetBarrierDevice(struct PointerBarrierClient *c, int deviceid)
+ {
+- struct PointerBarrierDevice *pbd = NULL;
++ struct PointerBarrierDevice *p, *pbd = NULL;
+
+- xorg_list_for_each_entry(pbd, &c->per_device, entry) {
+- if (pbd->deviceid == deviceid)
++ xorg_list_for_each_entry(p, &c->per_device, entry) {
++ if (p->deviceid == deviceid) {
++ pbd = p;
+ break;
++ }
+ }
+
+- BUG_WARN(!pbd);
+ return pbd;
+ }
+
+@@ -340,6 +341,9 @@ barrier_find_nearest(BarrierScreenPtr cs, DeviceIntPtr dev,
+ double distance;
+
+ pbd = GetBarrierDevice(c, dev->id);
++ if (!pbd)
++ continue;
++
+ if (pbd->seen)
+ continue;
+
+@@ -448,6 +452,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
+ nearest = &c->barrier;
+
+ pbd = GetBarrierDevice(c, master->id);
++ if (!pbd)
++ continue;
++
+ new_sequence = !pbd->hit;
+
+ pbd->seen = TRUE;
+@@ -488,6 +495,9 @@ input_constrain_cursor(DeviceIntPtr dev, ScreenPtr screen,
+ int flags = 0;
+
+ pbd = GetBarrierDevice(c, master->id);
++ if (!pbd)
++ continue;
++
+ pbd->seen = FALSE;
+ if (!pbd->hit)
+ continue;
+@@ -682,6 +692,9 @@ BarrierFreeBarrier(void *data, XID id)
+ continue;
+
+ pbd = GetBarrierDevice(c, dev->id);
++ if (!pbd)
++ continue;
++
+ if (!pbd->hit)
+ continue;
+
+@@ -741,6 +754,8 @@ static void remove_master_func(void *res, XID id, void *devid)
+ barrier = container_of(b, struct PointerBarrierClient, barrier);
+
+ pbd = GetBarrierDevice(barrier, *deviceid);
++ if (!pbd)
++ return;
+
+ if (pbd->hit) {
+ BarrierEvent ev = {
+@@ -905,6 +920,10 @@ ProcXIBarrierReleasePointer(ClientPtr client)
+ barrier = container_of(b, struct PointerBarrierClient, barrier);
+
+ pbd = GetBarrierDevice(barrier, dev->id);
++ if (!pbd) {
++ client->errorValue = dev->id;
++ return BadDevice;
++ }
+
+ if (pbd->barrier_event_id == event_id)
+ pbd->release_event_id = event_id;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 0303e39de4..9138e1dd0e 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -34,6 +34,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26595.patch \
file://CVE-2025-26596.patch \
file://CVE-2025-26597.patch \
+ file://CVE-2025-26598.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 13/16] xwayland: Fix CVE-2025-26599
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (11 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 12/16] xwayland: Fix CVE-2025-26598 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 14/16] xwayland: Fix CVE-2025-26600 Steve Sakoman
` (2 subsequent siblings)
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
The patches are copied from xserver-xorg recipe.
CVE reported for both and patches apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be & https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26599-1.patch | 66 +++++++++
.../xwayland/xwayland/CVE-2025-26599-2.patch | 129 ++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 2 +
3 files changed, 197 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch
new file mode 100644
index 0000000000..60b68a0d9a
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-1.patch
@@ -0,0 +1,66 @@
+From c1ff84bef2569b4ba4be59323cf575d1798ba9be Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Tue, 17 Dec 2024 15:19:45 +0100
+Subject: [PATCH] composite: Handle failure to redirect in compRedirectWindow()
+
+The function compCheckRedirect() may fail if it cannot allocate the
+backing pixmap.
+
+In that case, compRedirectWindow() will return a BadAlloc error.
+
+However that failure code path will shortcut the validation of the
+window tree marked just before, which leaves the validate data partly
+initialized.
+
+That causes a use of uninitialized pointer later.
+
+The fix is to not shortcut the call to compHandleMarkedWindows() even in
+the case of compCheckRedirect() returning an error.
+
+CVE-2025-26599, ZDI-CAN-25851
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be]
+CVE: CVE-2025-26599
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ composite/compalloc.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/composite/compalloc.c b/composite/compalloc.c
+index eaabf0d..0bbbc55 100644
+--- a/composite/compalloc.c
++++ b/composite/compalloc.c
+@@ -140,6 +140,7 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
+ CompScreenPtr cs = GetCompScreen(pWin->drawable.pScreen);
+ WindowPtr pLayerWin;
+ Bool anyMarked = FALSE;
++ int status = Success;
+
+ if (pWin == cs->pOverlayWin) {
+ return Success;
+@@ -218,13 +219,13 @@ compRedirectWindow(ClientPtr pClient, WindowPtr pWin, int update)
+
+ if (!compCheckRedirect(pWin)) {
+ FreeResource(ccw->id, RT_NONE);
+- return BadAlloc;
++ status = BadAlloc;
+ }
+
+ if (anyMarked)
+ compHandleMarkedWindows(pWin, pLayerWin);
+
+- return Success;
++ return status;
+ }
+
+ void
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch
new file mode 100644
index 0000000000..252b033261
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26599-2.patch
@@ -0,0 +1,129 @@
+From b07192a8bedb90b039dc0f70ae69daf047ff9598 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 13 Jan 2025 16:09:43 +0100
+Subject: [PATCH] composite: initialize border clip even when pixmap alloc
+ fails
+
+If it fails to allocate the pixmap, the function compAllocPixmap() would
+return early and leave the borderClip region uninitialized, which may
+lead to the use of uninitialized value as reported by valgrind:
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x4F9B33: compClipNotify (compwindow.c:317)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x48EEDBC: pixman_region_translate (pixman-region.c:2233)
+ by 0x4F9255: RegionTranslate (regionstr.h:312)
+ by 0x4F9B7E: compClipNotify (compwindow.c:319)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+ Conditional jump or move depends on uninitialised value(s)
+ at 0x48EEE33: UnknownInlinedFun (pixman-region.c:2241)
+ by 0x48EEE33: pixman_region_translate (pixman-region.c:2225)
+ by 0x4F9255: RegionTranslate (regionstr.h:312)
+ by 0x4F9B7E: compClipNotify (compwindow.c:319)
+ by 0x484FC9: miComputeClips (mivaltree.c:476)
+ by 0x48559A: miValidateTree (mivaltree.c:679)
+ by 0x4F0685: MapWindow (window.c:2693)
+ by 0x4A344A: ProcMapWindow (dispatch.c:922)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+ Uninitialised value was created by a heap allocation
+ at 0x4841866: malloc (vg_replace_malloc.c:446)
+ by 0x4F47BC: compRedirectWindow (compalloc.c:171)
+ by 0x4FA8AD: compCreateWindow (compwindow.c:592)
+ by 0x4EBB89: CreateWindow (window.c:925)
+ by 0x4A2E6E: ProcCreateWindow (dispatch.c:768)
+ by 0x4A25B5: Dispatch (dispatch.c:560)
+ by 0x4B082A: dix_main (main.c:282)
+ by 0x429233: main (stubmain.c:34)
+
+Fix compAllocPixmap() to initialize the border clip even if the creation
+of the backing pixmap has failed, to avoid depending later on
+uninitialized border clip values.
+
+Related to CVE-2025-26599, ZDI-CAN-25851
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8]
+CVE: CVE-2025-26599
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ composite/compalloc.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/composite/compalloc.c b/composite/compalloc.c
+index 7cf7351e00..4a1243170d 100644
+--- a/composite/compalloc.c
++++ b/composite/compalloc.c
+@@ -605,9 +605,12 @@ compAllocPixmap(WindowPtr pWin)
+ int h = pWin->drawable.height + (bw << 1);
+ PixmapPtr pPixmap = compNewPixmap(pWin, x, y, w, h);
+ CompWindowPtr cw = GetCompWindow(pWin);
++ Bool status;
+
+- if (!pPixmap)
+- return FALSE;
++ if (!pPixmap) {
++ status = FALSE;
++ goto out;
++ }
+ if (cw->update == CompositeRedirectAutomatic)
+ pWin->redirectDraw = RedirectDrawAutomatic;
+ else
+@@ -621,14 +624,16 @@ compAllocPixmap(WindowPtr pWin)
+ DamageRegister(&pWin->drawable, cw->damage);
+ cw->damageRegistered = TRUE;
+ }
++ status = TRUE;
+
++out:
+ /* Make sure our borderClip is up to date */
+ RegionUninit(&cw->borderClip);
+ RegionCopy(&cw->borderClip, &pWin->borderClip);
+ cw->borderClipX = pWin->drawable.x;
+ cw->borderClipY = pWin->drawable.y;
+
+- return TRUE;
++ return status;
+ }
+
+ void
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 9138e1dd0e..1e4a96f86f 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -35,6 +35,8 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26596.patch \
file://CVE-2025-26597.patch \
file://CVE-2025-26598.patch \
+ file://CVE-2025-26599-1.patch \
+ file://CVE-2025-26599-2.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 14/16] xwayland: Fix CVE-2025-26600
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (12 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 13/16] xwayland: Fix CVE-2025-26599 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 15/16] xwayland: Fix CVE-2025-26601 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 16/16] mesa: Fix missing GLES3 headers in SDK sysroot Steve Sakoman
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Patch copied from xserver-xorg recipe.
CVE reported for both and patch apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26600.patch | 68 +++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
2 files changed, 69 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch
new file mode 100644
index 0000000000..43b47b3ca3
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26600.patch
@@ -0,0 +1,68 @@
+From 6e0f332ba4c8b8c9a9945dc9d7989bfe06f80e14 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 16 Dec 2024 16:18:04 +0100
+Subject: [PATCH] dix: Dequeue pending events on frozen device on removal
+
+When a device is removed while still frozen, the events queued for that
+device remain while the device itself is freed.
+
+As a result, replaying the events will cause a use after free.
+
+To avoid the issue, make sure to dequeue and free any pending events on
+a frozen device when removed.
+
+CVE-2025-26600, ZDI-CAN-25871
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b]
+CVE: CVE-2025-26600
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ dix/devices.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/dix/devices.c b/dix/devices.c
+index 1516147..459f1ed 100644
+--- a/dix/devices.c
++++ b/dix/devices.c
+@@ -962,6 +962,23 @@ FreeAllDeviceClasses(ClassesPtr classes)
+
+ }
+
++static void
++FreePendingFrozenDeviceEvents(DeviceIntPtr dev)
++{
++ QdEventPtr qe, tmp;
++
++ if (!dev->deviceGrab.sync.frozen)
++ return;
++
++ /* Dequeue any frozen pending events */
++ xorg_list_for_each_entry_safe(qe, tmp, &syncEvents.pending, next) {
++ if (qe->device == dev) {
++ xorg_list_del(&qe->next);
++ free(qe);
++ }
++ }
++}
++
+ /**
+ * Close down a device and free all resources.
+ * Once closed down, the driver will probably not expect you that you'll ever
+@@ -1026,6 +1043,7 @@ CloseDevice(DeviceIntPtr dev)
+ free(dev->last.touches[j].valuators);
+ free(dev->last.touches);
+ dev->config_info = NULL;
++ FreePendingFrozenDeviceEvents(dev);
+ dixFreePrivates(dev->devPrivates, PRIVATE_DEVICE);
+ free(dev);
+ }
+--
+2.25.1
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index 1e4a96f86f..d90f9970b5 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -37,6 +37,7 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26598.patch \
file://CVE-2025-26599-1.patch \
file://CVE-2025-26599-2.patch \
+ file://CVE-2025-26600.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 15/16] xwayland: Fix CVE-2025-26601
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (13 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 14/16] xwayland: Fix CVE-2025-26600 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 16/16] mesa: Fix missing GLES3 headers in SDK sysroot Steve Sakoman
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
The patches are copied from xserver-xorg recipe.
CVE reported for both and patches apply on both.
Upstream-Commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d &
https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f &
https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../xwayland/xwayland/CVE-2025-26601-1.patch | 71 ++++++++++
.../xwayland/xwayland/CVE-2025-26601-2.patch | 85 +++++++++++
.../xwayland/xwayland/CVE-2025-26601-3.patch | 52 +++++++
.../xwayland/xwayland/CVE-2025-26601-4.patch | 132 ++++++++++++++++++
.../xwayland/xwayland_22.1.8.bb | 4 +
5 files changed, 344 insertions(+)
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch
new file mode 100644
index 0000000000..df5416a452
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-1.patch
@@ -0,0 +1,71 @@
+From 16a1242d0ffc7f45ed3c595ee7564b5c04287e0b Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 16:52:01 +0100
+Subject: [PATCH] sync: Do not let sync objects uninitialized
+
+When changing an alarm, the change mask values are evaluated one after
+the other, changing the trigger values as requested and eventually,
+SyncInitTrigger() is called.
+
+SyncInitTrigger() will evaluate the XSyncCACounter first and may free
+the existing sync object.
+
+Other changes are then evaluated and may trigger an error and an early
+return, not adding the new sync object.
+
+This can be used to cause a use after free when the alarm eventually
+triggers.
+
+To avoid the issue, delete the existing sync object as late as possible
+only once we are sure that no further error will cause an early exit.
+
+CVE-2025-26601, ZDI-CAN-25870
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index ee0010e657..585cfa6f68 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -360,11 +360,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ client->errorValue = syncObject;
+ return rc;
+ }
+- if (pSync != pTrigger->pSync) { /* new counter for trigger */
+- SyncDeleteTriggerFromSyncObject(pTrigger);
+- pTrigger->pSync = pSync;
+- newSyncObject = TRUE;
+- }
+ }
+
+ /* if system counter, ask it what the current value is */
+@@ -432,6 +427,14 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ }
+ }
+
++ if (changes & XSyncCACounter) {
++ if (pSync != pTrigger->pSync) { /* new counter for trigger */
++ SyncDeleteTriggerFromSyncObject(pTrigger);
++ pTrigger->pSync = pSync;
++ newSyncObject = TRUE;
++ }
++ }
++
+ /* we wait until we're sure there are no errors before registering
+ * a new counter on a trigger
+ */
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch
new file mode 100644
index 0000000000..22e751c017
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-2.patch
@@ -0,0 +1,85 @@
+From f52cea2f93a0c891494eb3334894442a92368030 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 16:54:30 +0100
+Subject: [PATCH] sync: Check values before applying changes
+
+In SyncInitTrigger(), we would set the CheckTrigger function before
+validating the counter value.
+
+As a result, if the counter value overflowed, we would leave the
+function SyncInitTrigger() with the CheckTrigger applied but without
+updating the trigger object.
+
+To avoid that issue, move the portion of code checking for the trigger
+check value before updating the CheckTrigger function.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 585cfa6f68..10302160fb 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -381,6 +381,24 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ }
+ }
+
++ if (changes & (XSyncCAValueType | XSyncCAValue)) {
++ if (pTrigger->value_type == XSyncAbsolute)
++ pTrigger->test_value = pTrigger->wait_value;
++ else { /* relative */
++ Bool overflow;
++
++ if (pCounter == NULL)
++ return BadMatch;
++
++ overflow = checked_int64_add(&pTrigger->test_value,
++ pCounter->value, pTrigger->wait_value);
++ if (overflow) {
++ client->errorValue = pTrigger->wait_value >> 32;
++ return BadValue;
++ }
++ }
++ }
++
+ if (changes & XSyncCATestType) {
+
+ if (pSync && SYNC_FENCE == pSync->type) {
+@@ -409,24 +427,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ }
+ }
+
+- if (changes & (XSyncCAValueType | XSyncCAValue)) {
+- if (pTrigger->value_type == XSyncAbsolute)
+- pTrigger->test_value = pTrigger->wait_value;
+- else { /* relative */
+- Bool overflow;
+-
+- if (pCounter == NULL)
+- return BadMatch;
+-
+- overflow = checked_int64_add(&pTrigger->test_value,
+- pCounter->value, pTrigger->wait_value);
+- if (overflow) {
+- client->errorValue = pTrigger->wait_value >> 32;
+- return BadValue;
+- }
+- }
+- }
+-
+ if (changes & XSyncCACounter) {
+ if (pSync != pTrigger->pSync) { /* new counter for trigger */
+ SyncDeleteTriggerFromSyncObject(pTrigger);
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch
new file mode 100644
index 0000000000..8d714f0302
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-3.patch
@@ -0,0 +1,52 @@
+From 8cbc90c8817306af75a60f494ec9dbb1061e50db Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 17:06:07 +0100
+Subject: [PATCH] sync: Do not fail SyncAddTriggerToSyncObject()
+
+We do not want to return a failure at the very last step in
+SyncInitTrigger() after having all changes applied.
+
+SyncAddTriggerToSyncObject() must not fail on memory allocation, if the
+allocation of the SyncTriggerList fails, trigger a FatalError() instead.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 10302160fb..65f2d43780 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -201,8 +201,8 @@ SyncAddTriggerToSyncObject(SyncTrigger * pTrigger)
+ return Success;
+ }
+
+- if (!(pCur = malloc(sizeof(SyncTriggerList))))
+- return BadAlloc;
++ /* Failure is not an option, it's succeed or burst! */
++ pCur = XNFalloc(sizeof(SyncTriggerList));
+
+ pCur->pTrigger = pTrigger;
+ pCur->next = pTrigger->pSync->pTriglist;
+@@ -439,8 +439,7 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
+ * a new counter on a trigger
+ */
+ if (newSyncObject) {
+- if ((rc = SyncAddTriggerToSyncObject(pTrigger)) != Success)
+- return rc;
++ SyncAddTriggerToSyncObject(pTrigger);
+ }
+ else if (pCounter && IsSystemCounter(pCounter)) {
+ SyncComputeBracketValues(pCounter);
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch
new file mode 100644
index 0000000000..e2261192fa
--- /dev/null
+++ b/meta/recipes-graphics/xwayland/xwayland/CVE-2025-26601-4.patch
@@ -0,0 +1,132 @@
+From c285798984c6bb99e454a33772cde23d394d3dcd Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Mon, 20 Jan 2025 17:10:31 +0100
+Subject: [PATCH] sync: Apply changes last in SyncChangeAlarmAttributes()
+
+SyncChangeAlarmAttributes() would apply the various changes while
+checking for errors.
+
+If one of the changes triggers an error, the changes for the trigger,
+counter or delta value would remain, possibly leading to inconsistent
+changes.
+
+Postpone the actual changes until we're sure nothing else can go wrong.
+
+Related to CVE-2025-26601, ZDI-CAN-25870
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989]
+CVE: CVE-2025-26601
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ Xext/sync.c | 42 +++++++++++++++++++++++++++---------------
+ 1 file changed, 27 insertions(+), 15 deletions(-)
+
+diff --git a/Xext/sync.c b/Xext/sync.c
+index 65f2d43780..cab73be927 100644
+--- a/Xext/sync.c
++++ b/Xext/sync.c
+@@ -830,8 +830,14 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ int status;
+ XSyncCounter counter;
+ Mask origmask = mask;
++ SyncTrigger trigger;
++ Bool select_events_changed = FALSE;
++ Bool select_events_value = FALSE;
++ int64_t delta;
+
+- counter = pAlarm->trigger.pSync ? pAlarm->trigger.pSync->id : None;
++ trigger = pAlarm->trigger;
++ delta = pAlarm->delta;
++ counter = trigger.pSync ? trigger.pSync->id : None;
+
+ while (mask) {
+ int index2 = lowbit(mask);
+@@ -847,24 +853,24 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ case XSyncCAValueType:
+ mask &= ~XSyncCAValueType;
+ /* sanity check in SyncInitTrigger */
+- pAlarm->trigger.value_type = *values++;
++ trigger.value_type = *values++;
+ break;
+
+ case XSyncCAValue:
+ mask &= ~XSyncCAValue;
+- pAlarm->trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
++ trigger.wait_value = ((int64_t)values[0] << 32) | values[1];
+ values += 2;
+ break;
+
+ case XSyncCATestType:
+ mask &= ~XSyncCATestType;
+ /* sanity check in SyncInitTrigger */
+- pAlarm->trigger.test_type = *values++;
++ trigger.test_type = *values++;
+ break;
+
+ case XSyncCADelta:
+ mask &= ~XSyncCADelta;
+- pAlarm->delta = ((int64_t)values[0] << 32) | values[1];
++ delta = ((int64_t)values[0] << 32) | values[1];
+ values += 2;
+ break;
+
+@@ -874,10 +880,8 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ client->errorValue = *values;
+ return BadValue;
+ }
+- status = SyncEventSelectForAlarm(pAlarm, client,
+- (Bool) (*values++));
+- if (status != Success)
+- return status;
++ select_events_value = (Bool) (*values++);
++ select_events_changed = TRUE;
+ break;
+
+ default:
+@@ -886,25 +890,33 @@ SyncChangeAlarmAttributes(ClientPtr client, SyncAlarm * pAlarm, Mask mask,
+ }
+ }
+
++ if (select_events_changed) {
++ status = SyncEventSelectForAlarm(pAlarm, client, select_events_value);
++ if (status != Success)
++ return status;
++ }
++
+ /* "If the test-type is PositiveComparison or PositiveTransition
+ * and delta is less than zero, or if the test-type is
+ * NegativeComparison or NegativeTransition and delta is
+ * greater than zero, a Match error is generated."
+ */
+ if (origmask & (XSyncCADelta | XSyncCATestType)) {
+- if ((((pAlarm->trigger.test_type == XSyncPositiveComparison) ||
+- (pAlarm->trigger.test_type == XSyncPositiveTransition))
+- && pAlarm->delta < 0)
++ if ((((trigger.test_type == XSyncPositiveComparison) ||
++ (trigger.test_type == XSyncPositiveTransition))
++ && delta < 0)
+ ||
+- (((pAlarm->trigger.test_type == XSyncNegativeComparison) ||
+- (pAlarm->trigger.test_type == XSyncNegativeTransition))
+- && pAlarm->delta > 0)
++ (((trigger.test_type == XSyncNegativeComparison) ||
++ (trigger.test_type == XSyncNegativeTransition))
++ && delta > 0)
+ ) {
+ return BadMatch;
+ }
+ }
+
+ /* postpone this until now, when we're sure nothing else can go wrong */
++ pAlarm->delta = delta;
++ pAlarm->trigger = trigger;
+ if ((status = SyncInitTrigger(client, &pAlarm->trigger, counter, RTCounter,
+ origmask & XSyncCAAllTrigger)) != Success)
+ return status;
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
index d90f9970b5..6affd80e22 100644
--- a/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
+++ b/meta/recipes-graphics/xwayland/xwayland_22.1.8.bb
@@ -38,6 +38,10 @@ SRC_URI = "https://www.x.org/archive/individual/xserver/xwayland-${PV}.tar.xz \
file://CVE-2025-26599-1.patch \
file://CVE-2025-26599-2.patch \
file://CVE-2025-26600.patch \
+ file://CVE-2025-26601-1.patch \
+ file://CVE-2025-26601-2.patch \
+ file://CVE-2025-26601-3.patch \
+ file://CVE-2025-26601-4.patch \
"
SRC_URI[sha256sum] = "d11eeee73290b88ea8da42a7d9350dedfaba856ce4ae44e58c045ad9ecaa2f73"
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 16/16] mesa: Fix missing GLES3 headers in SDK sysroot
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
` (14 preceding siblings ...)
2025-03-05 15:58 ` [OE-core][kirkstone 15/16] xwayland: Fix CVE-2025-26601 Steve Sakoman
@ 2025-03-05 15:58 ` Steve Sakoman
15 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-03-05 15:58 UTC (permalink / raw)
To: openembedded-core
From: Johannes Kauffmann <johanneskauffmann@hotmail.com>
Building weston with core-image-weston SDK fails:
```
../libweston/renderer-gl/gl-shader-config-color-transformation.c:29:10: fatal error: GLES3/gl3.h: No such file or directory
29 | #include <GLES3/gl3.h>
| ^~~~~~~~~~~~~
```
Both GLES2 and GLES3 implementations are contained in libGLESv2.so.2,
which is packaged in libgles2-mesa. However, the headers are split
between libgles2-mesa-dev and libgles3-mesa-dev, which is why the
GLES3 headers end up missing in the SDK sysroot.
Add a dependency so the GLES3 headers are properly associated with
the GLES3 implementation.
(From OE-Core rev: 7e1308ec413e69a8427ac5998431005d9e4b8033)
Signed-off-by: Tom Hochstein <tom.hochstein@oss.nxp.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Johannes Kauffmann <johanneskauffmann@hotmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-graphics/mesa/mesa.inc | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/meta/recipes-graphics/mesa/mesa.inc b/meta/recipes-graphics/mesa/mesa.inc
index afac8014fe..3c85a3ac55 100644
--- a/meta/recipes-graphics/mesa/mesa.inc
+++ b/meta/recipes-graphics/mesa/mesa.inc
@@ -191,6 +191,11 @@ RDEPENDS:${PN}-dev = ""
# development package of libgles3.
RDEPENDS:libgles3-mesa-dev += "libgles2-mesa-dev"
+# GLES2 and GLES3 implementations are packaged in a single library in libgles2-mesa.
+# Add a dependency so the GLES3 dev package is associated with its implementation.
+RDEPENDS:libgles2-mesa += "libgles3-mesa"
+ALLOW_EMPTY:libgles3-mesa = "1"
+
RDEPENDS:libopencl-mesa += "${@bb.utils.contains('PACKAGECONFIG', 'opencl', 'libclc spirv-tools', '', d)}"
PACKAGES =+ "libegl-mesa libegl-mesa-dev \
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [OE-core][kirkstone 00/16] Patch review
@ 2025-07-15 20:36 Steve Sakoman
0 siblings, 0 replies; 24+ messages in thread
From: Steve Sakoman @ 2025-07-15 20:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, July 17
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2021
The following changes since commit a7cea8a5c91d26ba7c3f72448f0897f5c2f81fd1:
linux-yocto/5.15: update to v5.15.186 (2025-07-08 09:05:09 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (4):
openssl: fix CVE-2024-41996
ofono: fix CVE-2023-4232
ofono: fix CVE-2023-4235
gdk-pixbuf: fix CVE-2025-7345
Chen Qi (2):
coreutils: fix CVE-2025-5278
sudo: upgrade from 1.9.15p2 to 1.9.15p5
Deepesh Varatharajan (1):
bintuils: stable 2.38 branch update
Guocai He (1):
tcf-agent: correct the SRC_URI
Hitendra Prajapati (1):
libxml2: fix CVE-2025-49794 & CVE-2025-49796
Peter Marko (4):
python3: update CVE product
openssl: upgrade 3.0.16 -> 3.0.17
ghostscript: ignore CVE-2025-46646
iputils: patch CVE-2025-48964
Praveen Kumar (1):
sudo: upgrade 1.9.15p5 -> 1.9.17p1
Ross Burton (1):
oeqa/core/decorator: add decorators to skip based on HOST_ARCH
Steve Sakoman (1):
Revert "coreutils: fix CVE-2025-5278"
meta/lib/oeqa/core/decorator/data.py | 24 +++
.../ofono/ofono/CVE-2023-4232.patch | 30 +++
.../ofono/ofono/CVE-2023-4235.patch | 37 ++++
meta/recipes-connectivity/ofono/ofono_1.34.bb | 2 +
.../openssl/openssl/CVE-2024-41996.patch | 48 +++++
.../{openssl_3.0.16.bb => openssl_3.0.17.bb} | 3 +-
.../coreutils/coreutils/CVE-2025-5278.patch | 10 +-
.../CVE-2025-49794-CVE-2025-49796.patch | 181 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.14.bb | 1 +
.../binutils/binutils-2.38.inc | 2 +-
.../python/python3_3.10.18.bb | 2 +-
.../tcf-agent/tcf-agent_git.bb | 2 +-
.../ghostscript/ghostscript_9.55.0.bb | 2 +
.../iputils/iputils/CVE-2025-48964.patch | 99 ++++++++++
.../iputils/iputils_20211215.bb | 1 +
...o.conf.in-fix-conflict-with-multilib.patch | 7 +-
meta/recipes-extended/sudo/sudo.inc | 2 +-
.../{sudo_1.9.15p2.bb => sudo_1.9.17p1.bb} | 54 +++++-
.../gdk-pixbuf/gdk-pixbuf/CVE-2025-7345.patch | 55 ++++++
.../gdk-pixbuf/gdk-pixbuf_2.42.10.bb | 1 +
20 files changed, 548 insertions(+), 15 deletions(-)
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2023-4232.patch
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2023-4235.patch
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-41996.patch
rename meta/recipes-connectivity/openssl/{openssl_3.0.16.bb => openssl_3.0.17.bb} (98%)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-49794-CVE-2025-49796.patch
create mode 100644 meta/recipes-extended/iputils/iputils/CVE-2025-48964.patch
rename meta/recipes-extended/sudo/{sudo_1.9.15p2.bb => sudo_1.9.17p1.bb} (52%)
create mode 100644 meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-7345.patch
--
2.43.0
^ permalink raw reply [flat|nested] 24+ messages in thread
end of thread, other threads:[~2025-07-15 20:36 UTC | newest]
Thread overview: 24+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-05 15:58 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 01/16] libxml2: mark patch as fixing CVE-2025-27113 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 02/16] xwayland: Fix CVE-2024-21885 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 03/16] xwayland: Fix CVE-2024-21886 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 04/16] xwayland: Fix CVE-2024-31080 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 05/16] xwayland: Fix CVE-2024-31081 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 06/16] xwayland: Fix CVE-2024-31083 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 07/16] xwayland: Fix CVE-2024-9632 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 08/16] xwayland: Fix CVE-2025-26594 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 09/16] xwayland: Fix CVE-2025-26595 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 10/16] xwayland: Fix CVE-2025-26596 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 11/16] xwayland: Fix CVE-2025-26597 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 12/16] xwayland: Fix CVE-2025-26598 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 13/16] xwayland: Fix CVE-2025-26599 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 14/16] xwayland: Fix CVE-2025-26600 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 15/16] xwayland: Fix CVE-2025-26601 Steve Sakoman
2025-03-05 15:58 ` [OE-core][kirkstone 16/16] mesa: Fix missing GLES3 headers in SDK sysroot Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-07-15 20:36 [OE-core][kirkstone 00/16] Patch review Steve Sakoman
2025-01-20 17:50 Steve Sakoman
2024-10-02 13:12 Steve Sakoman
2024-02-27 21:56 Steve Sakoman
2023-11-22 2:30 Steve Sakoman
2023-08-17 2:49 Steve Sakoman
2022-09-13 14:17 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox