From owner-svn-ports-all@FreeBSD.ORG Thu Oct 24 13:05:11 2013 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id B896DF47; Thu, 24 Oct 2013 13:05:11 +0000 (UTC) (envelope-from kwm@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 972152CE0; Thu, 24 Oct 2013 13:05:11 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9OD5BCV073182; Thu, 24 Oct 2013 13:05:11 GMT (envelope-from kwm@svn.freebsd.org) Received: (from kwm@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9OD5AbM073178; Thu, 24 Oct 2013 13:05:10 GMT (envelope-from kwm@svn.freebsd.org) Message-Id: <201310241305.r9OD5AbM073178@svn.freebsd.org> From: Koop Mast Date: Thu, 24 Oct 2013 13:05:10 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r331484 - in head: security/vuxml x11-servers/xorg-server x11-servers/xorg-server/files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Oct 2013 13:05:11 -0000 Author: kwm Date: Thu Oct 24 13:05:10 2013 New Revision: 331484 URL: http://svnweb.freebsd.org/changeset/ports/331484 Log: Document xorg-server use after free CVE. Reviewed by: zeising@ Added: head/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c (contents, props changed) head/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c (contents, props changed) Modified: head/security/vuxml/vuln.xml head/x11-servers/xorg-server/Makefile Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Thu Oct 24 13:02:54 2013 (r331483) +++ head/security/vuxml/vuln.xml Thu Oct 24 13:05:10 2013 (r331484) @@ -51,6 +51,36 @@ Note: Please add new entries to the beg --> + + xorg-server -- use after free + + + xorg-server + 1.7.01.7.7_11 + 1.12.01.12.4_4 + + + + +

Alan Coopersmith reports:

+
Pedro Ribeiro (pedrib at gmail.com) reported an issue to the X.Org + security team in which an authenticated X client can cause an X + server to use memory after it was freed, potentially leading to + crash and/or memory corruption.
+

+ + + + CVE-2013-4396 + http://lists.x.org/archives/xorg-announce/2013-October/002332.html + + + 2013-10-08 + 2013-10-24 + + + pycrypto -- PRNG reseed race condition Modified: head/x11-servers/xorg-server/Makefile ============================================================================== --- head/x11-servers/xorg-server/Makefile Thu Oct 24 13:02:54 2013 (r331483) +++ head/x11-servers/xorg-server/Makefile Thu Oct 24 13:05:10 2013 (r331484) @@ -35,20 +35,22 @@ OPTIONS_EXCLUDE_sparc64= HAL .if defined(WITH_NEW_XORG) XORG_VERSION= 1.12.4 -XORG_REVISION= 3 +XORG_REVISION= 4 PLIST_SUB+= OLD="@comment " NEW="" EXTRA_PATCHES+= ${FILESDIR}/extra-clang \ - ${FILESDIR}/extra-configure + ${FILESDIR}/extra-configure \ + ${FILESDIR}/extra-new-dix_dixfonts.c .else XORG_VERSION= 1.7.7 -XORG_REVISION= 10 +XORG_REVISION= 11 PLIST_SUB+= OLD="" NEW="@comment " EXTRA_PATCHES+= ${FILESDIR}/extra-Xext-xace.c \ ${FILESDIR}/extra-Xserver-os-xprintf.c \ ${FILESDIR}/extra-include_eventstr.h \ ${FILESDIR}/extra-os-utils.c \ ${FILESDIR}/extra-dix_events.c \ - ${FILESDIR}/extra-Xserver-hw-xfree86-common-xf86Config.c + ${FILESDIR}/extra-Xserver-hw-xfree86-common-xf86Config.c \ + ${FILESDPR}/extra-old-dix_dixfonts.c .endif USE_BZIP2= yes Added: head/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/x11-servers/xorg-server/files/extra-new-dix_dixfonts.c Thu Oct 24 13:05:10 2013 (r331484) @@ -0,0 +1,41 @@ +--- dix/dixfonts.c.orig 2012-05-17 19:09:01.000000000 +0200 ++++ dix/dixfonts.c 2013-10-09 10:49:38.158284440 +0200 +@@ -1414,6 +1414,7 @@ + GC *pGC; + unsigned char *data; + ITclosurePtr new_closure; ++ ITclosurePtr old_closure; + + /* We're putting the client to sleep. We need to + save some state. Similar problem to that handled +@@ -1425,12 +1426,14 @@ + err = BadAlloc; + goto bail; + } ++ old_closure = c; + *new_closure = *c; + c = new_closure; + + data = malloc(c->nChars * itemSize); + if (!data) { + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1441,6 +1444,7 @@ + if (!pGC) { + free(c->data); + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1453,6 +1457,7 @@ + FreeScratchGC(pGC); + free(c->data); + free(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } Added: head/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/x11-servers/xorg-server/files/extra-old-dix_dixfonts.c Thu Oct 24 13:05:10 2013 (r331484) @@ -0,0 +1,42 @@ +--- dix/dixfonts.c.orig 2010-05-04 02:47:57.000000000 +0200 ++++ dix/dixfonts.c 2013-10-09 10:54:40.488267646 +0200 +@@ -1508,6 +1508,7 @@ + GC *pGC; + unsigned char *data; + ITclosurePtr new_closure; ++ ITclosurePtr old_closure; + + /* We're putting the client to sleep. We need to + save some state. Similar problem to that handled +@@ -1520,6 +1521,7 @@ + err = BadAlloc; + goto bail; + } ++ old_closure = c; + *new_closure = *c; + c = new_closure; + +@@ -1527,6 +1529,7 @@ + if (!data) + { + xfree(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1538,6 +1541,7 @@ + { + xfree(c->data); + xfree(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + } +@@ -1551,6 +1555,7 @@ + FreeScratchGC(pGC); + xfree(c->data); + xfree(c); ++ c = old_closure; + err = BadAlloc; + goto bail; + }