diff options
| author | Matthieu Herrb <matthieu@herrb.eu> | 2024-10-10 10:37:28 +0200 |
|---|---|---|
| committer | José Expósito <jexposit@redhat.com> | 2024-10-29 16:26:59 +0100 |
| commit | 26120df7aae6b5bf8086fb4d871d3b1a07ddacdb (patch) | |
| tree | d6a1aa163ee187ab35e25450a5a9a0d7ad0e8b60 | |
| parent | 113245b1ab0b219fa569c808f4da45ffe298e33a (diff) | |
xkb: Fix buffer overflow in _XkbSetCompatMap()
The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.
However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.
This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).
CVE-2024-9632, ZDI-CAN-24756
This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Tested-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: José Expósito <jexposit@redhat.com>
(cherry picked from commit 85b776571487f52e756f68a069c768757369bfe3)
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1735>
| -rw-r--r-- | xkb/xkb.c | 8 |
1 files changed, 4 insertions, 4 deletions
@@ -2990,13 +2990,13 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev, XkbSymInterpretPtr sym; unsigned int skipped = 0; - if ((unsigned) (req->firstSI + req->nSI) > compat->num_si) { - compat->num_si = req->firstSI + req->nSI; + if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) { + compat->num_si = compat->size_si = req->firstSI + req->nSI; compat->sym_interpret = reallocarray(compat->sym_interpret, - compat->num_si, + compat->size_si, sizeof(XkbSymInterpretRec)); if (!compat->sym_interpret) { - compat->num_si = 0; + compat->num_si = compat->size_si = 0; return BadAlloc; } } |