Skip to content

Commit 63a4e07

Browse files
archana25-msarchana25-ms
authored
1 parent b5e2f2f commit 63a4e07

6 files changed

Lines changed: 245 additions & 1 deletion

File tree

‎SPECS/xorg-x11-server/CVE-2025-49175.patch‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
From 0885e0b26225c90534642fe911632ec0779eebee Mon Sep 17 00:00:00 2001
2+
From: Olivier Fourdan <ofourdan@redhat.com>
3+
Date: Fri, 28 Mar 2025 09:43:52 +0100
4+
Subject: [PATCH] render: Avoid 0 or less animated cursors
5+
Upstream Patch Reference: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0885e0b26225c90534642fe911632ec0779eebee
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
Animated cursors use a series of cursors that the client can set.
11+
12+
By default, the Xserver assumes at least one cursor is specified
13+
while a client may actually pass no cursor at all.
14+
15+
That causes an out-of-bound read creating the animated cursor and a
16+
crash of the Xserver:
17+
18+
| Invalid read of size 8
19+
| at 0x5323F4: AnimCursorCreate (animcur.c:325)
20+
| by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
21+
| by 0x52DC80: ProcRenderDispatch (render.c:1999)
22+
| by 0x4A1E9D: Dispatch (dispatch.c:560)
23+
| by 0x4B0169: dix_main (main.c:284)
24+
| by 0x4287F5: main (stubmain.c:34)
25+
| Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd
26+
| at 0x48468D3: reallocarray (vg_replace_malloc.c:1803)
27+
| by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802)
28+
| by 0x52DC80: ProcRenderDispatch (render.c:1999)
29+
| by 0x4A1E9D: Dispatch (dispatch.c:560)
30+
| by 0x4B0169: dix_main (main.c:284)
31+
| by 0x4287F5: main (stubmain.c:34)
32+
|
33+
| Invalid read of size 2
34+
| at 0x5323F7: AnimCursorCreate (animcur.c:325)
35+
| by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817)
36+
| by 0x52DC80: ProcRenderDispatch (render.c:1999)
37+
| by 0x4A1E9D: Dispatch (dispatch.c:560)
38+
| by 0x4B0169: dix_main (main.c:284)
39+
| by 0x4287F5: main (stubmain.c:34)
40+
| Address 0x8 is not stack'd, malloc'd or (recently) free'd
41+
42+
To avoid the issue, check the number of cursors specified and return a
43+
BadValue error in both the proc handler (early) and the animated cursor
44+
creation (as this is a public function) if there is 0 or less cursor.
45+
46+
CVE-2025-49175
47+
48+
This issue was discovered by Nils Emmerich <nemmerich@ernw.de> and
49+
reported by Julian Suleder via ERNW Vulnerability Disclosure.
50+
51+
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
52+
Reviewed-by: José Expósito <jexposit@redhat.com>
53+
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2024>
54+
---
55+
render/animcur.c | 3 +++
56+
render/render.c | 2 ++
57+
2 files changed, 5 insertions(+)
58+
59+
diff --git a/render/animcur.c b/render/animcur.c
60+
index f906cd8130..1194cee7e7 100644
61+
--- a/render/animcur.c
62+
+++ b/render/animcur.c
63+
@@ -305,6 +305,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor,
64+
int rc = BadAlloc, i;
65+
AnimCurPtr ac;
66+
67+
+ if (ncursor <= 0)
68+
+ return BadValue;
69+
+
70+
for (i = 0; i < screenInfo.numScreens; i++)
71+
if (!GetAnimCurScreen(screenInfo.screens[i]))
72+
return BadImplementation;
73+
diff --git a/render/render.c b/render/render.c
74+
index 113f6e0c5a..fe9f03c8c8 100644
75+
--- a/render/render.c
76+
+++ b/render/render.c
77+
@@ -1799,6 +1799,8 @@ ProcRenderCreateAnimCursor(ClientPtr client)
78+
ncursor =
79+
(client->req_len -
80+
(bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1;
81+
+ if (ncursor <= 0)
82+
+ return BadValue;
83+
cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32));
84+
if (!cursors)
85+
return BadAlloc;
86+
--
87+
GitLab
88+

‎SPECS/xorg-x11-server/CVE-2025-49176.patch‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
From 0aef94544400d8014db5a2ff89f71c9cf796a1e4 Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
3+
Date: Mon, 23 Jun 2025 21:17:42 -0500
4+
Subject: [PATCH] Address CVE-2025-49176
5+
Upstream Patch Reference: https://gitlab.freedesktop.org/xorg/xserver/-/commit/03731b326a80b582e48d939fe62cb1e2b10400d9
6+
7+
---
8+
dix/dispatch.c | 9 +++++----
9+
os/io.c | 4 ++++
10+
2 files changed, 9 insertions(+), 4 deletions(-)
11+
12+
diff --git a/dix/dispatch.c b/dix/dispatch.c
13+
index cdec481..34cb34d 100644
14+
--- a/dix/dispatch.c
15+
+++ b/dix/dispatch.c
16+
@@ -447,9 +447,10 @@ Dispatch(void)
17+
18+
/* now, finally, deal with client requests */
19+
result = ReadRequestFromClient(client);
20+
- if (result <= 0) {
21+
- if (result < 0)
22+
- CloseDownClient(client);
23+
+ if (result == 0)
24+
+ break;
25+
+ else if (result == -1) {
26+
+ CloseDownClient(client);
27+
break;
28+
}
29+
30+
@@ -470,7 +471,7 @@ Dispatch(void)
31+
client->index,
32+
client->requestBuffer);
33+
#endif
34+
- if (result > (maxBigRequestSize << 2))
35+
+ if (result < 0 || result > (maxBigRequestSize << 2))
36+
result = BadLength;
37+
else {
38+
result = XaceHookDispatch(client, client->majorOp);
39+
diff --git a/os/io.c b/os/io.c
40+
index 939f517..a053008 100644
41+
--- a/os/io.c
42+
+++ b/os/io.c
43+
@@ -296,6 +296,10 @@ ReadRequestFromClient(ClientPtr client)
44+
needed = get_big_req_len(request, client);
45+
}
46+
client->req_len = needed;
47+
+ if (needed > MAXINT >> 2) {
48+
+ /* Check for potential integer overflow */
49+
+ return -(BadLength);
50+
+ }
51+
needed <<= 2; /* needed is in bytes now */
52+
}
53+
if (gotnow < needed) {
54+
--
55+
2.45.2
56+

‎SPECS/xorg-x11-server/CVE-2025-49178.patch‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 802a0db9ab3151c33904f90a1f28c386ec9a5644 Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
3+
Date: Mon, 23 Jun 2025 21:19:23 -0500
4+
Subject: [PATCH] Address CVE-2025-49178
5+
Upstream Patch Reference: https://gitlab.freedesktop.org/xorg/xserver/-/commit/d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2
6+
7+
---
8+
os/io.c | 2 +-
9+
1 file changed, 1 insertion(+), 1 deletion(-)
10+
11+
diff --git a/os/io.c b/os/io.c
12+
index a053008..d1096d9 100644
13+
--- a/os/io.c
14+
+++ b/os/io.c
15+
@@ -442,7 +442,7 @@ ReadRequestFromClient(ClientPtr client)
16+
*/
17+
18+
gotnow -= needed;
19+
- if (!gotnow)
20+
+ if (!gotnow && !oci->ignoreBytes)
21+
AvailableInput = oc;
22+
if (move_header) {
23+
if (client->req_len < bytes_to_int32(sizeof(xBigReq) - sizeof(xReq))) {
24+
--
25+
2.45.2
26+

‎SPECS/xorg-x11-server/CVE-2025-49179.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
From dc2a01eaa17374992688d6b4f5b351863c1c19f5 Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
3+
Date: Mon, 23 Jun 2025 22:31:41 -0500
4+
Subject: [PATCH] Address CVE-2025-49179
5+
Upstream Patch Reference: https://gitlab.freedesktop.org/xorg/xserver/-/commit/2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4
6+
7+
---
8+
record/record.c | 8 ++++++++
9+
1 file changed, 8 insertions(+)
10+
11+
diff --git a/record/record.c b/record/record.c
12+
index 05d751a..9851677 100644
13+
--- a/record/record.c
14+
+++ b/record/record.c
15+
@@ -1289,6 +1289,7 @@ RecordPadAlign(int size, int align)
16+
*
17+
* Side Effects: none.
18+
*/
19+
+extern int LimitClients;
20+
static int
21+
RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client,
22+
xRecordRegisterClientsReq * stuff)
23+
@@ -1298,6 +1299,13 @@ RecordSanityCheckRegisterClients(RecordContextPtr pContext, ClientPtr client,
24+
int i;
25+
XID recordingClient;
26+
27+
+ /* LimitClients is 2048 at max, way less that MAXINT */
28+
+ if (stuff->nClients > LimitClients)
29+
+ return BadValue;
30+
+
31+
+ if (stuff->nRanges > (MAXINT - 4 * stuff->nClients) / SIZEOF(xRecordRange))
32+
+ return BadValue;
33+
+
34+
if (((client->req_len << 2) - SIZEOF(xRecordRegisterClientsReq)) !=
35+
4 * stuff->nClients + SIZEOF(xRecordRange) * stuff->nRanges)
36+
return BadLength;
37+
--
38+
2.45.2
39+

‎SPECS/xorg-x11-server/CVE-2025-49180.patch‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From 14338a8cc031594f939f118e9a8f12caee78718d Mon Sep 17 00:00:00 2001
2+
From: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>
3+
Date: Mon, 23 Jun 2025 22:32:52 -0500
4+
Subject: [PATCH] Address CVE-2025-49180
5+
Upstream Patch Reference: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3c3a4b767b16174d3213055947ea7f4f88e10ec6
6+
7+
---
8+
randr/rrproviderproperty.c | 3 ++-
9+
1 file changed, 2 insertions(+), 1 deletion(-)
10+
11+
diff --git a/randr/rrproviderproperty.c b/randr/rrproviderproperty.c
12+
index 90c5a9a..0aa35ad 100644
13+
--- a/randr/rrproviderproperty.c
14+
+++ b/randr/rrproviderproperty.c
15+
@@ -179,7 +179,8 @@ RRChangeProviderProperty(RRProviderPtr provider, Atom property, Atom type,
16+
17+
if (mode == PropModeReplace || len > 0) {
18+
void *new_data = NULL, *old_data = NULL;
19+
-
20+
+ if (total_len > MAXINT / size_in_bytes)
21+
+ return BadValue;
22+
total_size = total_len * size_in_bytes;
23+
new_value.data = (void *) malloc(total_size);
24+
if (!new_value.data && total_size) {
25+
--
26+
2.45.2
27+

‎SPECS/xorg-x11-server/xorg-x11-server.spec‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: X.Org X11 X server
2222
Name: xorg-x11-server
2323
Version: 1.20.10
24-
Release: 15%{?dist}
24+
Release: 16%{?dist}
2525
License: MIT
2626
Vendor: Microsoft Corporation
2727
Distribution: Mariner
@@ -78,6 +78,11 @@ Patch28: CVE-2025-26598.patch
7878
Patch29: CVE-2025-26599.patch
7979
Patch30: CVE-2025-26600.patch
8080
Patch31: CVE-2025-26601.patch
81+
Patch32: CVE-2025-49175.patch
82+
Patch33: CVE-2025-49176.patch
83+
Patch34: CVE-2025-49178.patch
84+
Patch35: CVE-2025-49179.patch
85+
Patch36: CVE-2025-49180.patch
8186

8287
# Backported Xwayland randr resolution change emulation support
8388
Patch501: 0001-dix-Add-GetCurrentClient-helper.patch
@@ -411,6 +416,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
411416
%{_datadir}/aclocal/xorg-server.m4
412417

413418
%changelog
419+
* Mon Jun 23 2025 Archana Shettigar <v-shettigara@microsoft.com> - 1.20.10-16
420+
- Patch CVE-2025-49175, CVE-2025-49176, CVE-2025-49178, CVE-2025-49179 & CVE-2025-49180
421+
414422
* Tue Mar 04 2025 Kanishk Bansal <kanbansal@microsft.com> - 1.20.10-15
415423
- Patch CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601
416424

0 commit comments

Comments
 (0)