frederik
/
xserver
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
xserver/Xext
History
Olivier Fourdan 16a1242d0f sync: Do not let sync objects uninitialized 
When changing an alarm, the change mask values are evaluated one after
the other, changing the trigger values as requested and eventually,
SyncInitTrigger() is called.

SyncInitTrigger() will evaluate the XSyncCACounter first and may free
the existing sync object.

Other changes are then evaluated and may trigger an error and an early
return, not adding the new sync object.

This can be used to cause a use after free when the alarm eventually
triggers.

To avoid the issue, delete the existing sync object as late as possible
only once we are sure that no further error will cause an early exit.

CVE-2025-26601, ZDI-CAN-25870

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1828>
 		2025-02-25 11:43:01 +01:00
..
bigreq.c Xext: bigreq: drop swapping request length fields 2025-02-06 22:28:49 +00:00
dpms.c Xext: dpms: need to include geext.h 2025-02-24 20:19:55 +00:00
dpmsproc.h dpms: Consolidate a bunch of stuff into Xext/dpms.c 2017-03-27 15:59:47 -04:00
geext.c misc.h: move out MAXEXTENSIONS to geext.c 2025-02-24 20:19:55 +00:00
geext.h Xext: geext.h: fix missing include of Xfuncproto.h 2025-02-23 17:53:25 +00:00
hashtable.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
hashtable.h Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
meson.build panoramix: don't install panoramiX.h and panoramiXsrv.h 2025-02-24 20:06:30 +00:00
panoramiX.c os: move out extension disable flags to corresponing extensions 2025-02-07 12:00:53 +01:00
panoramiX.h Xext: drop _PANORAMIX_SERVER 2024-06-23 19:31:46 +00:00
panoramiXSwap.c Xext: panoramiX: drop now obsolete swap procs 2025-02-06 22:28:51 +00:00
panoramiXh.h Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
panoramiXprocs.c dix: unexport Ones() 2024-10-26 16:35:57 +00:00
panoramiXsrv.h Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
saver.c Xext: saver: use dixDestroyPixmap() instead of direct driver call 2025-02-12 17:48:30 +01:00
security.c os: unexport AuthorizationIDOfClient() 2025-02-18 10:53:44 +00:00
securitysrv.h Xext: securitysrv.h: drop hacks for including secur.h 2024-06-23 19:20:12 +00:00
shape.c os: move out extension disable flags to corresponing extensions 2025-02-07 12:00:53 +01:00
shm.c os: unexport WriteFdToClient() 2025-02-18 10:53:44 +00:00
shmint.h xext: Fix shmint.h to not use headers outside of sdk_HEADERS 2013-11-14 10:22:15 +09:00
sleepuntil.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
sleepuntil.h Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
sync.c sync: Do not let sync objects uninitialized 2025-02-25 11:43:01 +01:00
syncsdk.h xsync: Add resource inside of SyncCreate, export SyncCreate 2019-04-17 14:01:17 -07:00
syncsrv.h sync: Convert from "CARD64" to int64_t. 2017-09-20 13:19:27 -04:00
vidmode.c Xext: vidmode: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
xace.c os: unexport ClientIsLocal() 2025-02-18 10:53:44 +00:00
xace.h xace: typesafe hook function for XACE_KEY_AVAIL 2024-06-23 21:07:48 +00:00
xacestr.h Replace 'pointer' type with 'void *' 2014-01-12 10:24:11 -08:00
xcmisc.c Xext: xcmisc: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
xf86bigfont.c os: move out extension disable flags to corresponing extensions 2025-02-07 12:00:53 +01:00
xf86bigfontsrv.h Move extension initialisation prototypes into extinit.h 2012-07-09 23:06:41 -07:00
xres.c os: move out extension disable flags to corresponing extensions 2025-02-07 12:00:53 +01:00
xselinux.h include: unpexport SELINUX_* consts from include/global.h 2024-03-25 19:40:04 +00:00
xselinux_ext.c Xext: selinux: use static reply struct init on declaration 2025-02-17 18:58:10 +00:00
xselinux_hooks.c os: split off internal definitions from client.h 2024-10-10 13:45:29 +00:00
xselinux_label.c drop obsolete HAVE_DIX_CONFIG_H 2024-10-10 13:38:31 +00:00
xselinuxint.h include: drop obsolete registry.h 2024-03-03 23:20:06 +00:00
xtest.c os: unexport ResetCurrentRequest() 2025-02-18 10:53:45 +00:00
xvdisp.c Xext: xv: drop now obsolete swap procs 2025-02-06 22:28:52 +00:00
xvdisp.h Fix swapped Xv dispatch under Xinerama. 2007-12-02 14:15:36 -05:00
xvdix.h Revert "xv: unexport XvScreenRec and XvScreenPtr" 2025-02-07 10:08:41 +01:00
xvdix_priv.h Revert "xv: unexport XvScreenRec and XvScreenPtr" 2025-02-07 10:08:41 +01:00
xvmain.c treewide: NULL-protect ScreenRec->DestroyPixmap() calls 2025-02-06 23:02:06 +00:00
xvmc.c xvmc: move over protocol version defines into xvmc.c 2025-02-06 23:29:10 +00:00
xvmcext.h xvmc: unexport XvMCFindXvImage() 2024-10-10 19:59:48 +00:00