Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (01ad7d0b66d421cd0e2f88bd3e3cdad9e0d73bf1)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Pavel Vinogradov <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (01ad7d0b66d421cd0e2f88bd3e3cdad9e0d73bf1)
  • Date: Wed, 15 Dec 2021 00:42:32 +0000

GIT changes to master grimoire by Pavel Vinogradov <public AT sourcemaage.org>:

xorg/xserver/DETAILS | 2 -
xorg/xserver/HISTORY | 4 ++
xorg/xserver/patches/CVE-2021-4008.patch | 52
+++++++++++++++++++++++++++++++
xorg/xserver/patches/CVE-2021-4009.patch | 43 +++++++++++++++++++++++++
xorg/xserver/patches/CVE-2021-4010.patch | 32 +++++++++++++++++++
xorg/xserver/patches/CVE-2021-4011.patch | 33 +++++++++++++++++++
6 files changed, 165 insertions(+), 1 deletion(-)

New commits:
commit 01ad7d0b66d421cd0e2f88bd3e3cdad9e0d73bf1
Author: Pavel Vinogradov <public AT sourcemaage.org>
Commit: Pavel Vinogradov <public AT sourcemaage.org>

xorg/xserver: SECURITY_PATCH++, (CVE-2021-40[08-11])

diff --git a/xorg/xserver/DETAILS b/xorg/xserver/DETAILS
index cb5ae82..026ec37 100755
--- a/xorg/xserver/DETAILS
+++ b/xorg/xserver/DETAILS
@@ -12,7 +12,7 @@ source $GRIMOIRE/MESON_FUNCTIONS
WEB_SITE=https://xorg.freedesktop.org/
ENTERED=20180228
LICENSE[0]=XCL
- SECURITY_PATCH=15
+ SECURITY_PATCH=16
SHORT="X servers (including Xorg, Xprt, Xvfb, Xnest & Xdmx)"
cat << EOF
X servers (including Xorg, Xwayland, Xvfb, Xnest & Xdmx), the core of the X
diff --git a/xorg/xserver/HISTORY b/xorg/xserver/HISTORY
index 97d9643..bd320d6 100644
--- a/xorg/xserver/HISTORY
+++ b/xorg/xserver/HISTORY
@@ -1,3 +1,7 @@
+2021-12-14 Pavel Vinogradov <public AT sourcemage.org>
+ * DETAILS: SECURITY_PATCH++, (CVE-2021-40[08-11])
+ * patches/CVE-2021-40[08-11].patch: added corresponding patches
+
2021-11-07 Treeve Jelbert <treeve AT sourcemage.org>
* DETAILS: version 21.1.1

diff --git a/xorg/xserver/patches/CVE-2021-4008.patch
b/xorg/xserver/patches/CVE-2021-4008.patch
new file mode 100644
index 0000000..e13edff
--- /dev/null
+++ b/xorg/xserver/patches/CVE-2021-4008.patch
@@ -0,0 +1,52 @@
+From ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60 Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas AT radix.lt>
+Date: Tue, 14 Dec 2021 15:00:03 +0200
+Subject: [PATCH] render: Fix out of bounds access in
+ SProcRenderCompositeGlyphs()
+
+ZDI-CAN-14192, CVE-2021-4008
+
+This vulnerability was discovered and the fix was suggested by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Povilas Kanapickas <povilas AT radix.lt>
+---
+ render/render.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/render/render.c b/render/render.c
+index c376090ca..456f156d4 100644
+--- a/render/render.c
++++ b/render/render.c
+@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
+
+ i = elt->len;
+ if (i == 0xff) {
++ if (buffer + 4 > end) {
++ return BadLength;
++ }
+ swapl((int *) buffer);
+ buffer += 4;
+ }
+@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
+ buffer += i;
+ break;
+ case 2:
++ if (buffer + i * 2 > end) {
++ return BadLength;
++ }
+ while (i--) {
+ swaps((short *) buffer);
+ buffer += 2;
+ }
+ break;
+ case 4:
++ if (buffer + i * 4 > end) {
++ return BadLength;
++ }
+ while (i--) {
+ swapl((int *) buffer);
+ buffer += 4;
+--
+GitLab
+
diff --git a/xorg/xserver/patches/CVE-2021-4009.patch
b/xorg/xserver/patches/CVE-2021-4009.patch
new file mode 100644
index 0000000..9a5c3fe
--- /dev/null
+++ b/xorg/xserver/patches/CVE-2021-4009.patch
@@ -0,0 +1,43 @@
+From b5196750099ae6ae582e1f46bd0a6dad29550e02 Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas AT radix.lt>
+Date: Tue, 14 Dec 2021 15:00:01 +0200
+Subject: [PATCH] xfixes: Fix out of bounds access in
+ *ProcXFixesCreatePointerBarrier()
+
+ZDI-CAN-14950, CVE-2021-4009
+
+This vulnerability was discovered and the fix was suggested by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Povilas Kanapickas <povilas AT radix.lt>
+---
+ xfixes/cursor.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/xfixes/cursor.c b/xfixes/cursor.c
+index 60580b88f..c5d4554b2 100644
+--- a/xfixes/cursor.c
++++ b/xfixes/cursor.c
+@@ -1010,7 +1010,8 @@ ProcXFixesCreatePointerBarrier(ClientPtr client)
+ {
+ REQUEST(xXFixesCreatePointerBarrierReq);
+
+- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
pad_to_int32(stuff->num_devices));
++ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
++ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
+ LEGAL_NEW_RESOURCE(stuff->barrier, client);
+
+ return XICreatePointerBarrier(client, stuff);
+@@ -1027,7 +1028,8 @@ SProcXFixesCreatePointerBarrier(ClientPtr client)
+
+ swaps(&stuff->length);
+ swaps(&stuff->num_devices);
+- REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
pad_to_int32(stuff->num_devices));
++ REQUEST_FIXED_SIZE(xXFixesCreatePointerBarrierReq,
++ pad_to_int32(stuff->num_devices * sizeof(CARD16)));
+
+ swapl(&stuff->barrier);
+ swapl(&stuff->window);
+--
+GitLab
+
diff --git a/xorg/xserver/patches/CVE-2021-4010.patch
b/xorg/xserver/patches/CVE-2021-4010.patch
new file mode 100644
index 0000000..49e2346
--- /dev/null
+++ b/xorg/xserver/patches/CVE-2021-4010.patch
@@ -0,0 +1,32 @@
+From 6c4c53010772e3cb4cb8acd54950c8eec9c00d21 Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas AT radix.lt>
+Date: Tue, 14 Dec 2021 15:00:02 +0200
+Subject: [PATCH] Xext: Fix out of bounds access in SProcScreenSaverSuspend()
+
+ZDI-CAN-14951, CVE-2021-4010
+
+This vulnerability was discovered and the fix was suggested by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Povilas Kanapickas <povilas AT radix.lt>
+---
+ Xext/saver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Xext/saver.c b/Xext/saver.c
+index 1d7e3cadf..f813ba08d 100644
+--- a/Xext/saver.c
++++ b/Xext/saver.c
+@@ -1351,8 +1351,8 @@ SProcScreenSaverSuspend(ClientPtr client)
+ REQUEST(xScreenSaverSuspendReq);
+
+ swaps(&stuff->length);
+- swapl(&stuff->suspend);
+ REQUEST_SIZE_MATCH(xScreenSaverSuspendReq);
++ swapl(&stuff->suspend);
+ return ProcScreenSaverSuspend(client);
+ }
+
+--
+GitLab
+
diff --git a/xorg/xserver/patches/CVE-2021-4011.patch
b/xorg/xserver/patches/CVE-2021-4011.patch
new file mode 100644
index 0000000..2f3e419
--- /dev/null
+++ b/xorg/xserver/patches/CVE-2021-4011.patch
@@ -0,0 +1,33 @@
+From e56f61c79fc3cee26d83cda0f84ae56d5979f768 Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas AT radix.lt>
+Date: Tue, 14 Dec 2021 15:00:00 +0200
+Subject: [PATCH] record: Fix out of bounds access in SwapCreateRegister()
+
+ZDI-CAN-14952, CVE-2021-4011
+
+This vulnerability was discovered and the fix was suggested by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Povilas Kanapickas <povilas AT radix.lt>
+---
+ record/record.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/record/record.c b/record/record.c
+index be154525d..e123867a7 100644
+--- a/record/record.c
++++ b/record/record.c
+@@ -2516,8 +2516,8 @@ SwapCreateRegister(ClientPtr client,
xRecordRegisterClientsReq * stuff)
+ swapl(pClientID);
+ }
+ if (stuff->nRanges >
+- client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
+- - stuff->nClients)
++ (client->req_len - bytes_to_int32(sz_xRecordRegisterClientsReq)
++ - stuff->nClients) / bytes_to_int32(sz_xRecordRange))
+ return BadLength;
+ RecordSwapRanges((xRecordRange *) pClientID, stuff->nRanges);
+ return Success;
+--
+GitLab
+



  • [SM-Commit] GIT changes to master grimoire by Pavel Vinogradov (01ad7d0b66d421cd0e2f88bd3e3cdad9e0d73bf1), Pavel Vinogradov, 12/14/2021

Archive powered by MHonArc 2.6.24.

Top of Page