mirror of
https://git.yoctoproject.org/git/poky
synced 2026-01-01 13:58:04 +00:00
9e67c38d67
>From https://lists.x.org/archives/xorg-announce/2025-October/003635.html: 1) CVE-2025-62229: Use-after-free in XPresentNotify structures creation Using the X11 Present extension, when processing and adding the notifications after presenting a pixmap, if an error occurs, a dangling pointer may be left in the error code path of the function causing a use-after-free when eventually destroying the notification structures later. Introduced in: Xorg 1.15 Fixed in: xorg-server-21.1.19 and xwayland-24.1.9 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5a4286b1 Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative. 2) CVE-2025-62230: Use-after-free in Xkb client resource removal When removing the Xkb resources for a client, the function XkbRemoveResourceClient() will free the XkbInterest data associated with the device, but not the resource associated with it. As a result, when the client terminates, the resource delete function triggers a use-after-free. Introduced in: X11R6 Fixed in: xorg-server-21.1.19 and xwayland-24.1.9 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/99790a2c https://gitlab.freedesktop.org/xorg/xserver/-/commit/10c94238 Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative. 3) CVE-2025-62231: Value overflow in Xkb extension XkbSetCompatMap() The XkbCompatMap structure stores some of its values using an unsigned short, but fails to check whether the sum of the input data might overflow the maximum unsigned short value. Introduced in: X11R6 Fixed in: xorg-server-21.1.19 and xwayland-24.1.9 Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/475d9f49 Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative. (From OE-Core rev: 50b9c34ba932761fab9035a54e58466d72b097bf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
54 lines
1.8 KiB
Diff
54 lines
1.8 KiB
Diff
From 364f06788f1de4edc0547c7f29d338e6deffc138 Mon Sep 17 00:00:00 2001
|
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
|
Date: Wed, 10 Sep 2025 16:30:29 +0200
|
|
Subject: [PATCH 4/4] xkb: Prevent overflow in XkbSetCompatMap()
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
The XkbCompatMap structure stores its "num_si" and "size_si" fields
|
|
using an unsigned short.
|
|
|
|
However, the function _XkbSetCompatMap() will store the sum of the
|
|
input data "firstSI" and "nSI" in both XkbCompatMap's "num_si" and
|
|
"size_si" without first checking if the sum overflows the maximum
|
|
unsigned short value, leading to a possible overflow.
|
|
|
|
To avoid the issue, check whether the sum does not exceed the maximum
|
|
unsigned short value, or return a "BadValue" error otherwise.
|
|
|
|
CVE-2025-62231, ZDI-CAN-27560
|
|
|
|
This vulnerability was discovered by:
|
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
|
|
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
|
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
|
|
(cherry picked from commit 475d9f49acd0e55bc0b089ed77f732ad18585470)
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2087>
|
|
|
|
CVE: CVE-2025-62231
|
|
Upstream-Status: Backport
|
|
Signed-off-by: Ross Burton <ross.burton@arm.com>
|
|
---
|
|
xkb/xkb.c | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/xkb/xkb.c b/xkb/xkb.c
|
|
index 26d965d48..137d70da2 100644
|
|
--- a/xkb/xkb.c
|
|
+++ b/xkb/xkb.c
|
|
@@ -2992,6 +2992,8 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
|
|
XkbSymInterpretPtr sym;
|
|
unsigned int skipped = 0;
|
|
|
|
+ if ((unsigned) (req->firstSI + req->nSI) > USHRT_MAX)
|
|
+ return BadValue;
|
|
if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
|
|
compat->num_si = compat->size_si = req->firstSI + req->nSI;
|
|
compat->sym_interpret = reallocarray(compat->sym_interpret,
|
|
--
|
|
2.43.0
|
|
|