All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Steve Sakoman" <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][dunfell 07/41] xserver-xorg: fix CVE-2020-14346/14361/14362
Date: Wed, 30 Sep 2020 12:11:09 -1000	[thread overview]
Message-ID: <d485870543fbc111832735ae713b2ec405ce78fa.1601502610.git.steve@sakoman.com> (raw)
In-Reply-To: <cover.1601502610.git.steve@sakoman.com>

From: Chee Yang Lee <chee.yang.lee@intel.com>

fix :
CVE-2020-14346
https://gitlab.freedesktop.org/xorg/xserver/-/commit/c940cc8b6c0a2983c1ec974f1b3f019795dd4cff

CVE-2020-14361
https://gitlab.freedesktop.org/xorg/xserver/-/commit/144849ea27230962227e62a943b399e2ab304787

CVE-2020-14362
https://gitlab.freedesktop.org/xorg/xserver/-/commit/2902b78535ecc6821cc027351818b28a5c7fdbdc

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 .../xserver-xorg/CVE-2020-14346.patch         | 36 ++++++++++
 .../xserver-xorg/CVE-2020-14361.patch         | 36 ++++++++++
 .../xserver-xorg/CVE-2020-14362.patch         | 70 +++++++++++++++++++
 .../xorg-xserver/xserver-xorg_1.20.8.bb       |  3 +
 4 files changed, 145 insertions(+)
 create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14346.patch
 create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14361.patch
 create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch

diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14346.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14346.patch
new file mode 100644
index 0000000000..4994a21d33
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14346.patch
@@ -0,0 +1,36 @@
+From c940cc8b6c0a2983c1ec974f1b3f019795dd4cff Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Tue, 18 Aug 2020 14:49:04 +0200
+Subject: [PATCH] Fix XIChangeHierarchy() integer underflow
+
+CVE-2020-14346 / ZDI-CAN-11429
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+
+Upstream-Status: Backport
+[https://gitlab.freedesktop.org/xorg/xserver/-/commit/c940cc8b6c0a2983c1ec974f1b3f019795dd4cff]
+CVE: CVE-2020-14346
+Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
+---
+ Xi/xichangehierarchy.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xi/xichangehierarchy.c b/Xi/xichangehierarchy.c
+index cbdd91258..504defe56 100644
+--- a/Xi/xichangehierarchy.c
++++ b/Xi/xichangehierarchy.c
+@@ -423,7 +423,7 @@ ProcXIChangeHierarchy(ClientPtr client)
+     if (!stuff->num_changes)
+         return rc;
+ 
+-    len = ((size_t)stuff->length << 2) - sizeof(xXIChangeHierarchyReq);
++    len = ((size_t)client->req_len << 2) - sizeof(xXIChangeHierarchyReq);
+ 
+     any = (xXIAnyHierarchyChangeInfo *) &stuff[1];
+     while (stuff->num_changes--) {
+-- 
+2.17.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14361.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14361.patch
new file mode 100644
index 0000000000..710cc3873c
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14361.patch
@@ -0,0 +1,36 @@
+From 144849ea27230962227e62a943b399e2ab304787 Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Tue, 18 Aug 2020 14:52:29 +0200
+Subject: [PATCH] Fix XkbSelectEvents() integer underflow
+
+CVE-2020-14361 ZDI-CAN 11573
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+
+Upstream-Status: Backport
+[https://gitlab.freedesktop.org/xorg/xserver/-/commit/144849ea27230962227e62a943b399e2ab304787]
+CVE: CVE-2020-14361
+Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
+---
+ xkb/xkbSwap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/xkb/xkbSwap.c b/xkb/xkbSwap.c
+index 1c1ed5ff4..50cabb90e 100644
+--- a/xkb/xkbSwap.c
++++ b/xkb/xkbSwap.c
+@@ -76,7 +76,7 @@ SProcXkbSelectEvents(ClientPtr client)
+         register unsigned bit, ndx, maskLeft, dataLeft, size;
+ 
+         from.c8 = (CARD8 *) &stuff[1];
+-        dataLeft = (stuff->length * 4) - SIZEOF(xkbSelectEventsReq);
++        dataLeft = (client->req_len * 4) - SIZEOF(xkbSelectEventsReq);
+         maskLeft = (stuff->affectWhich & (~XkbMapNotifyMask));
+         for (ndx = 0, bit = 1; (maskLeft != 0); ndx++, bit <<= 1) {
+             if (((bit & maskLeft) == 0) || (ndx == XkbMapNotify))
+-- 
+2.17.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch
new file mode 100644
index 0000000000..2103e9c198
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2020-14362.patch
@@ -0,0 +1,70 @@
+From 2902b78535ecc6821cc027351818b28a5c7fdbdc Mon Sep 17 00:00:00 2001
+From: Matthieu Herrb <matthieu@herrb.eu>
+Date: Tue, 18 Aug 2020 14:55:01 +0200
+Subject: [PATCH] Fix XRecordRegisterClients() Integer underflow
+
+CVE-2020-14362 ZDI-CAN-11574
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
+
+Upstream-Status: Backport
+[https://gitlab.freedesktop.org/xorg/xserver/-/commit/2902b78535ecc6821cc027351818b28a5c7fdbdc]
+CVE: CVE-2020-14362
+Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
+---
+ record/record.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/record/record.c b/record/record.c
+index f2d38c877..be154525d 100644
+--- a/record/record.c
++++ b/record/record.c
+@@ -2500,7 +2500,7 @@ SProcRecordQueryVersion(ClientPtr client)
+ }                               /* SProcRecordQueryVersion */
+ 
+ static int _X_COLD
+-SwapCreateRegister(xRecordRegisterClientsReq * stuff)
++SwapCreateRegister(ClientPtr client, xRecordRegisterClientsReq * stuff)
+ {
+     int i;
+     XID *pClientID;
+@@ -2510,13 +2510,13 @@ SwapCreateRegister(xRecordRegisterClientsReq * stuff)
+     swapl(&stuff->nRanges);
+     pClientID = (XID *) &stuff[1];
+     if (stuff->nClients >
+-        stuff->length - bytes_to_int32(sz_xRecordRegisterClientsReq))
++        client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq))
+         return BadLength;
+     for (i = 0; i < stuff->nClients; i++, pClientID++) {
+         swapl(pClientID);
+     }
+     if (stuff->nRanges >
+-        stuff->length - bytes_to_int32(sz_xRecordRegisterClientsReq)
++        client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
+         - stuff->nClients)
+         return BadLength;
+     RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
+@@ -2531,7 +2531,7 @@ SProcRecordCreateContext(ClientPtr client)
+ 
+     swaps(&stuff->length);
+     REQUEST_AT_LEAST_SIZE(xRecordCreateContextReq);
+-    if ((status = SwapCreateRegister((void *) stuff)) != Success)
++    if ((status = SwapCreateRegister(client, (void *) stuff)) != Success)
+         return status;
+     return ProcRecordCreateContext(client);
+ }                               /* SProcRecordCreateContext */
+@@ -2544,7 +2544,7 @@ SProcRecordRegisterClients(ClientPtr client)
+ 
+     swaps(&stuff->length);
+     REQUEST_AT_LEAST_SIZE(xRecordRegisterClientsReq);
+-    if ((status = SwapCreateRegister((void *) stuff)) != Success)
++    if ((status = SwapCreateRegister(client, (void *) stuff)) != Success)
+         return status;
+     return ProcRecordRegisterClients(client);
+ }                               /* SProcRecordRegisterClients */
+-- 
+2.17.1
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.8.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.8.bb
index 5101134538..51d959f86c 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.8.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_1.20.8.bb
@@ -6,6 +6,9 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat
            file://sdksyms-no-build-path.patch \
            file://0001-drmmode_display.c-add-missing-mi.h-include.patch \
            file://CVE-2020-14347.patch \
+           file://CVE-2020-14346.patch \
+           file://CVE-2020-14361.patch \
+           file://CVE-2020-14362.patch \
            "
 SRC_URI[md5sum] = "a770aec600116444a953ff632f51f839"
 SRC_URI[sha256sum] = "d17b646bee4ba0fb7850c1cc55b18e3e8513ed5c02bdf38da7e107f84e2d0146"
-- 
2.17.1


  parent reply	other threads:[~2020-09-30 22:12 UTC|newest]

Thread overview: 42+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-30 22:11 [OE-core][dunfell 00/41] Patch review Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 01/41] python3-markupsafe: Import from meta-oe/meta-python Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 02/41] python3-jinja2: " Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 03/41] buildtools-tarball: Add python3-jinja2 Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 04/41] site: Make sys_siglist default to no Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 05/41] qemu : fix CVE-2020-16092 Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 06/41] bash : inlcude patch 17 & 18 Steve Sakoman
2020-09-30 22:11 ` Steve Sakoman [this message]
2020-09-30 22:11 ` [OE-core][dunfell 08/41] libx11: fix CVE-2020-14363 Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 09/41] cve-update-db-native: be less magical about checking whether the cve-check class is enabled Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 10/41] cve-update-db-native: move -journal checking into do_fetch Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 11/41] cve-update-db-native: remove unused variable Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 12/41] alsa-plugins: improve .la removal Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 13/41] sato-screenshot: " Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 14/41] insane: Check for feature check variables not being used Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 15/41] insane: check for missing update-alternatives inherit Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 16/41] xinput-calibrator: change SRC_URI to branch with libinput support Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 17/41] dropbear/openssh: Lower priority of key generation Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 18/41] testexport: rename create_tarball method Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 19/41] packagegroups: remove strace and lttng-tools for rv32/musl Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 20/41] curl: Change SRC_URI from http to https Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 21/41] meta: add/fix invalid Upstream-Status tags Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 22/41] buildtools: Handle generic environment setup injection Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 23/41] buildtools-tarball: Fix conflicts with oe-selftest and other tooling Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 24/41] oeqa/qemurunner: Increase serial timeout Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 25/41] oeqa/selftest/incompatible_lib: Fix append usage Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 26/41] oeqa/selftest/containerimage: Update to match assumptions in configuration Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 27/41] ssh-pregen-hostkeys: Add a recipe with pregenerated ssh host keys Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 28/41] bash: fix CVE-2019-18276 Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 29/41] packagegroup: rrecommend perf also for musl on ARM Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 30/41] sysvinit rc: Use PSPLASH_FIFO_DIR for progress fifo Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 31/41] openssh: Allow enable/disable of rng-tools recommendation on sshd Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 32/41] sstate.bbclass: Check file ownership before doing 'touch -a' Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 33/41] kernel-yocto: add KBUILD_DEFCONFIG search location to failure message Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 34/41] linux-yocto/config: netfilter: Enable nat for ipv4 and ipv6 Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 35/41] linux-yocto/5.4: update to v5.4.64 Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 36/41] linux-yocto/5.4: update to v5.4.65 Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 37/41] lttng-modules: backport writeback.h changes from 2.12.x to fix kernel 5.4.62+ Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 38/41] wic: Add --offset argument for partitions Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 39/41] wic: Fix --extra-space argument handling Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 40/41] wic: Fix error message when reporting invalid offset Steve Sakoman
2020-09-30 22:11 ` [OE-core][dunfell 41/41] wic: Add 512 Byte alignment to --offset Steve Sakoman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d485870543fbc111832735ae713b2ec405ce78fa.1601502610.git.steve@sakoman.com \
    --to=steve@sakoman.com \
    --cc=openembedded-core@lists.openembedded.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.