frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

xkb: Fix buffer overflow in _XkbSetCompatMap() 

The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.

However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.

This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).

CVE-2024-9632, ZDI-CAN-24756

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: José Expósito <jexposit@redhat.com>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1733>
This commit is contained in:
Matthieu Herrb 2024-10-10 10:37:28 +02:00 committed by José Expósito
parent bf63d9b34e
commit 85b7765714
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
xkb/xkb.c
View File

@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
XkbSymInterpretPtr sym; XkbSymInterpretPtr sym;
unsigned int skipped = 0; unsigned int skipped = 0;
if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) { if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
compat->num_si = req->firstSI + req->nSI; compat->num_si = compat->size_si = req->firstSI + req->nSI;
compat->sym_interpret = reallocarray(compat->sym_interpret, compat->sym_interpret = reallocarray(compat->sym_interpret,
compat->num_si, compat->size_si,
sizeof(XkbSymInterpretRec)); sizeof(XkbSymInterpretRec));
if (!compat->sym_interpret) { if (!compat->sym_interpret) {
compat->num_si = 0; compat->num_si = compat->size_si = 0;
return BadAlloc; return BadAlloc;
} }
} }