Skip to content

Commit f4d9443

Browse files
CBL-Mariner-BotAlberto-Perez-Guevara
CBL-Mariner-Bot
and
Alberto-Perez-Guevara
authored
[AUTO-CHERRYPICK] Add CVE-2023-5574, CVE-2023-5367 & CVE-2023-5380 patch to xorg-x11-server ver 1.20.10 - branch main (#8609)
Co-authored-by: Alberto Perez <aperezguevar@microsoft.com>
1 parent c749e02 commit f4d9443

4 files changed

Lines changed: 230 additions & 1 deletion

File tree

‎SPECS/xorg-x11-server/CVE-2023-5367.patch‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
diff --git a/Xi/xiproperty.c b/Xi/xiproperty.c
2+
index 6ec419e..563c4f3 100644
3+
--- a/Xi/xiproperty.c
4+
+++ b/Xi/xiproperty.c
5+
@@ -730,7 +730,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
6+
XIDestroyDeviceProperty(prop);
7+
return BadAlloc;
8+
}
9+
- new_value.size = len;
10+
+ new_value.size = total_len;
11+
new_value.type = type;
12+
new_value.format = format;
13+
14+
@@ -747,7 +747,7 @@ XIChangeDeviceProperty(DeviceIntPtr dev, Atom property, Atom type,
15+
case PropModePrepend:
16+
new_data = new_value.data;
17+
old_data = (void *) (((char *) new_value.data) +
18+
- (prop_value->size * size_in_bytes));
19+
+ (len * size_in_bytes));
20+
break;
21+
}
22+
if (new_data)
23+
diff --git a/randr/rrproperty.c b/randr/rrproperty.c
24+
index c2fb958..25469f5 100644
25+
--- a/randr/rrproperty.c
26+
+++ b/randr/rrproperty.c
27+
@@ -209,7 +209,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
28+
RRDestroyOutputProperty(prop);
29+
return BadAlloc;
30+
}
31+
- new_value.size = len;
32+
+ new_value.size = total_len;
33+
new_value.type = type;
34+
new_value.format = format;
35+
36+
@@ -226,7 +226,7 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
37+
case PropModePrepend:
38+
new_data = new_value.data;
39+
old_data = (void *) (((char *) new_value.data) +
40+
- (prop_value->size * size_in_bytes));
41+
+ (len * size_in_bytes));
42+
break;
43+
}
44+
if (new_data)

‎SPECS/xorg-x11-server/CVE-2023-5380.patch‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
diff --git a/dix/enterleave.h b/dix/enterleave.h
2+
index 4b833d8..e8af924 100644
3+
--- a/dix/enterleave.h
4+
+++ b/dix/enterleave.h
5+
@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev,
6+
7+
extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
8+
9+
-extern void LeaveWindow(DeviceIntPtr dev);
10+
-
11+
extern void CoreFocusEvent(DeviceIntPtr kbd,
12+
int type, int mode, int detail, WindowPtr pWin);
13+
14+
diff --git a/include/eventstr.h b/include/eventstr.h
15+
index bf3b95f..2bae3b0 100644
16+
--- a/include/eventstr.h
17+
+++ b/include/eventstr.h
18+
@@ -296,4 +296,7 @@ union _InternalEvent {
19+
#endif
20+
};
21+
22+
+extern void
23+
+LeaveWindow(DeviceIntPtr dev);
24+
+
25+
#endif
26+
diff --git a/mi/mipointer.c b/mi/mipointer.c
27+
index 75be1ae..b12ae9b 100644
28+
--- a/mi/mipointer.c
29+
+++ b/mi/mipointer.c
30+
@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y)
31+
#ifdef PANORAMIX
32+
&& noPanoramiXExtension
33+
#endif
34+
- )
35+
- UpdateSpriteForScreen(pDev, pScreen);
36+
+ ) {
37+
+ DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
38+
+ /* Hack for CVE-2023-5380: if we're moving
39+
+ * screens PointerWindows[] keeps referring to the
40+
+ * old window. If that gets destroyed we have a UAF
41+
+ * bug later. Only happens when jumping from a window
42+
+ * to the root window on the other screen.
43+
+ * Enter/Leave events are incorrect for that case but
44+
+ * too niche to fix.
45+
+ */
46+
+ LeaveWindow(pDev);
47+
+ if (master)
48+
+ LeaveWindow(master);
49+
+ UpdateSpriteForScreen(pDev, pScreen);
50+
+ }
51+
}
52+
53+
/**

‎SPECS/xorg-x11-server/CVE-2023-5574.patch‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
diff --git a/dix/dispatch.c b/dix/dispatch.c
2+
index a33bfaa..9aaec28 100644
3+
--- a/dix/dispatch.c
4+
+++ b/dix/dispatch.c
5+
@@ -3819,6 +3819,12 @@ static int indexForScanlinePad[65] = {
6+
3 /* 64 bits per scanline pad unit */
7+
};
8+
9+
+static Bool
10+
+DefaultCloseScreen(ScreenPtr screen)
11+
+{
12+
+ return TRUE;
13+
+}
14+
+
15+
/*
16+
grow the array of screenRecs if necessary.
17+
call the device-supplied initialization procedure
18+
@@ -3878,6 +3884,9 @@ static int init_screen(ScreenPtr pScreen, int i, Bool gpu)
19+
PixmapWidthPaddingInfo[depth].notPower2 = 0;
20+
}
21+
}
22+
+
23+
+ pScreen->CloseScreen = DefaultCloseScreen;
24+
+
25+
return 0;
26+
}
27+
28+
diff --git a/fb/fb.h b/fb/fb.h
29+
index 8ab050d..404bca3 100644
30+
--- a/fb/fb.h
31+
+++ b/fb/fb.h
32+
@@ -410,6 +410,7 @@ typedef struct {
33+
#endif
34+
DevPrivateKeyRec gcPrivateKeyRec;
35+
DevPrivateKeyRec winPrivateKeyRec;
36+
+ CloseScreenProcPtr CloseScreen;
37+
} FbScreenPrivRec, *FbScreenPrivPtr;
38+
39+
#define fbGetScreenPrivate(pScreen) ((FbScreenPrivPtr) \
40+
diff --git a/fb/fbscreen.c b/fb/fbscreen.c
41+
index 4ab807a..831d998 100644
42+
--- a/fb/fbscreen.c
43+
+++ b/fb/fbscreen.c
44+
@@ -29,6 +29,7 @@
45+
Bool
46+
fbCloseScreen(ScreenPtr pScreen)
47+
{
48+
+ FbScreenPrivPtr screen_priv = fbGetScreenPrivate(pScreen);
49+
int d;
50+
DepthPtr depths = pScreen->allowedDepths;
51+
52+
@@ -37,9 +38,11 @@ fbCloseScreen(ScreenPtr pScreen)
53+
free(depths[d].vids);
54+
free(depths);
55+
free(pScreen->visuals);
56+
- if (pScreen->devPrivate)
57+
- FreePixmap((PixmapPtr)pScreen->devPrivate);
58+
- return TRUE;
59+
+
60+
+
61+
+ pScreen->CloseScreen = screen_priv->CloseScreen;
62+
+
63+
+ return pScreen->CloseScreen(pScreen);
64+
}
65+
66+
Bool
67+
@@ -144,6 +147,7 @@ fbFinishScreenInit(ScreenPtr pScreen, void *pbits, int xsize, int ysize,
68+
int dpix, int dpiy, int width, int bpp)
69+
#endif
70+
{
71+
+ FbScreenPrivPtr screen_priv;
72+
VisualPtr visuals;
73+
DepthPtr depths;
74+
int nvisuals;
75+
@@ -178,7 +182,11 @@ fbFinishScreenInit(ScreenPtr pScreen, void *pbits, int xsize, int ysize,
76+
defaultVisual, nvisuals, visuals))
77+
return FALSE;
78+
/* overwrite miCloseScreen with our own */
79+
+
80+
+ screen_priv = fbGetScreenPrivate(pScreen);
81+
+ screen_priv->CloseScreen = pScreen->CloseScreen;
82+
pScreen->CloseScreen = fbCloseScreen;
83+
+
84+
return TRUE;
85+
}
86+
87+
diff --git a/hw/vfb/InitOutput.c b/hw/vfb/InitOutput.c
88+
index d9f23f3..0a47363 100644
89+
--- a/hw/vfb/InitOutput.c
90+
+++ b/hw/vfb/InitOutput.c
91+
@@ -738,13 +738,6 @@ vfbCloseScreen(ScreenPtr pScreen)
92+
93+
pScreen->CloseScreen = pvfb->closeScreen;
94+
95+
- /*
96+
- * fb overwrites miCloseScreen, so do this here
97+
- */
98+
- if (pScreen->devPrivate)
99+
- (*pScreen->DestroyPixmap) (pScreen->devPrivate);
100+
- pScreen->devPrivate = NULL;
101+
-
102+
return pScreen->CloseScreen(pScreen);
103+
}
104+
105+
diff --git a/mi/miscrinit.c b/mi/miscrinit.c
106+
index 264622d..907e46a 100644
107+
--- a/mi/miscrinit.c
108+
+++ b/mi/miscrinit.c
109+
@@ -242,10 +242,10 @@ miScreenInit(ScreenPtr pScreen, void *pbits, /* pointer to screen bits */
110+
pScreen->numVisuals = numVisuals;
111+
pScreen->visuals = visuals;
112+
if (width) {
113+
+ pScreen->CloseScreen = miCloseScreen;
114+
#ifdef MITSHM
115+
ShmRegisterFbFuncs(pScreen);
116+
#endif
117+
- pScreen->CloseScreen = miCloseScreen;
118+
}
119+
/* else CloseScreen */
120+
/* QueryBestSize, SaveScreen, GetImage, GetSpans */

‎SPECS/xorg-x11-server/xorg-x11-server.spec‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
Summary: X.Org X11 X server
2222
Name: xorg-x11-server
2323
Version: 1.20.10
24-
Release: 7%{?dist}
24+
Release: 10%{?dist}
2525
License: MIT
2626
Vendor: Microsoft Corporation
2727
Distribution: Mariner
@@ -58,6 +58,9 @@ Patch8: CVE-2023-6377.patch
5858
Patch9: CVE-2023-6478.patch
5959
Patch10: CVE-2024-21885.patch
6060
Patch11: CVE-2023-6816.patch
61+
Patch12: CVE-2023-5574.patch
62+
Patch13: CVE-2023-5367.patch
63+
Patch14: CVE-2023-5380.patch
6164

6265
# Backported Xwayland randr resolution change emulation support
6366
Patch501: 0001-dix-Add-GetCurrentClient-helper.patch
@@ -388,6 +391,15 @@ find %{buildroot} -type f -name "*.la" -delete -print
388391
%{_datadir}/aclocal/xorg-server.m4
389392

390393
%changelog
394+
* Thu Mar 28 2024 Alberto David Perez Guevara <aperezguevar@microsoft.com> - 1.20.10-10
395+
- Add patch for CVE-2023-5380
396+
397+
* Thu Mar 28 2024 Alberto David Perez Guevara <aperezguevar@microsoft.com> - 1.20.10-9
398+
- Add patch for CVE-2023-5367
399+
400+
* Thu Mar 28 2024 Alberto David Perez Guevara <aperezguevar@microsoft.com> - 1.20.10-8
401+
- Add patch for CVE-2023-5574
402+
391403
* Mon Mar 12 2024 Aadhar Agarwal <aadagarwal@microsoft.com> - 1.20.10-7
392404
- Add patch for CVE-2023-6816
393405

0 commit comments

Comments
 (0)