File U_Xi-Zero-target-buffer-in-SProcXSendExtensionE... of Package xorg-x11-server

Overview Repositories Revisions Requests Users Attributes Meta

File U_Xi-Zero-target-buffer-in-SProcXSendExtensionEvent.patch of Package xorg-x11-server (Revision 47b28cd7dd9c83e261c80a2f33b8b208)

Currently displaying revision 47b28cd7dd9c83e261c80a2f33b8b208 , Show latest

Author: Michal Srb <msrb@suse.com>
Subject: Xi: Zero target buffer in SProcXSendExtensionEvent.
Git-commit: 05442de962d3dc624f79fc1a00eca3ffc5489ced
Patch-mainline: Upstream
References: bnc#1035283 CVE-2017-10972

Make sure that the xEvent eventT is initialized with zeros, the same way as
in SProcSendEvent.

Some event swapping functions do not overwrite all 32 bytes of xEvent
structure, for example XSecurityAuthorizationRevoked. Two cooperating
clients, one swapped and the other not, can send
XSecurityAuthorizationRevoked event to each other to retrieve old stack data
from X server. This can be potentialy misused to go around ASLR or
stack-protector.

Signed-off-by: Michal Srb <msrb@suse.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
---
 Xi/sendexev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Xi/sendexev.c b/Xi/sendexev.c
index 11d82029f..1cf118ab6 100644
--- a/Xi/sendexev.c
+++ b/Xi/sendexev.c
@@ -78,7 +78,7 @@ SProcXSendExtensionEvent(ClientPtr client)
 {
     CARD32 *p;
     int i;
-    xEvent eventT;
+    xEvent eventT = { .u.u.type = 0 };
     xEvent *eventP;
     EventSwapPtr proc;
 
-- 
2.12.0

Places

File U_Xi-Zero-target-buffer-in-SProcXSendExtensionEvent.patch of Package xorg-x11-server (Revision 47b28cd7dd9c83e261c80a2f33b8b208)

Places