Skip site navigation (1)Skip section navigation (2) 
Date:      Sat, 01 Aug 2020 11:39:26 +0000
From:      bugzilla-noreply@freebsd.org
To:        ports-bugs@FreeBSD.org
Subject:   [Bug 248410] x11-servers/xorg-server: fix CVE-2020-14347 (release 1.20.9 soon)
Message-ID:  <bug-248410-7788@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D248410

            Bug ID: 248410
           Summary: x11-servers/xorg-server: fix CVE-2020-14347 (release
                    1.20.9 soon)
           Product: Ports & Packages
           Version: Latest
          Hardware: Any
               URL: https://lists.x.org/archives/xorg-announce/2020-July/0
                    03051.html
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: Individual Port(s)
          Assignee: x11@FreeBSD.org
          Reporter: vvd@unislabs.com
                CC: joneum@FreeBSD.org, ports-secteam@FreeBSD.org
          Assignee: x11@FreeBSD.org
             Flags: maintainer-feedback?(x11@FreeBSD.org)
 Attachment #216935 maintainer-approval?
             Flags:
             Flags: maintainer-feedback?

Created attachment 216935
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D216935&action=
=3Dedit
fix CVE-2020-14347

X.Org security advisory: July 31, 2020

X Server Pixel Data Uninitialized Memory Information Disclosure=20
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

CVE-2020-14347

Allocation for pixmap data in AllocatePixmap() does not initialize the
memory in xserver, it leads to leak uninitialize heap memory to
clients. When the X server runs with elevated privileges.

This flaw can lead to ASLR bypass, which when combined with other
flaws (known/unknown) could lead to lead to privilege elevation in the
client.

Patch
=3D=3D=3D=3D=3D

A patch for this issue has been commited to the xorg server git
repository.  xorg-server 1.20.9 will be released shortly and will
include this patch.

https://gitlab.freedesktop.org/xorg/xserver.git

diff --git a/dix/pixmap.c b/dix/pixmap.c
index 1186d7dbb..5a0146bbb 100644
--- a/dix/pixmap.c
+++ b/dix/pixmap.c
@@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
     if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize)
         return NullPixmap;

-    pPixmap =3D malloc(pScreen->totalPixmapSize + pixDataSize);
+    pPixmap =3D calloc(1, pScreen->totalPixmapSize + pixDataSize);
     if (!pPixmap)
         return NullPixmap;

Thanks
=3D=3D=3D=3D=3D=3D

This vulnerability was discovered by Jan-Niklas Sohn working with
Trend Micro Zero Day Initiative.


Patch tested on 12.1 amd64: make check-plist/install.
I didn't restart xorg-server after this upgrade.

--=20
You are receiving this mail because:
You are the assignee for the bug.=

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-248410-7788>