From c45cee99279ddde53eee26b9b31194d91a175323 Mon Sep 17 00:00:00 2001 From: fandeyuan Date: Tue, 23 Sep 2025 20:16:26 +0800 Subject: [PATCH] render: Avoid 0 or less animated cursors --- ...2320.patch => 0012-fix-CVE-2022-2320.patch | 0 0013-fix-CVE-2025-49175.patch | 88 +++++++++++++++++++ xorg-x11-server-xwayland.spec | 8 +- 3 files changed, 94 insertions(+), 2 deletions(-) rename CVE-2022-2320.patch => 0012-fix-CVE-2022-2320.patch (100%) create mode 100644 0013-fix-CVE-2025-49175.patch diff --git a/CVE-2022-2320.patch b/0012-fix-CVE-2022-2320.patch similarity index 100% rename from CVE-2022-2320.patch rename to 0012-fix-CVE-2022-2320.patch diff --git a/0013-fix-CVE-2025-49175.patch b/0013-fix-CVE-2025-49175.patch new file mode 100644 index 0000000..aa823bb --- /dev/null +++ b/0013-fix-CVE-2025-49175.patch @@ -0,0 +1,88 @@ +From 0885e0b26225c90534642fe911632ec0779eebee Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Fri, 28 Mar 2025 09:43:52 +0100 +Subject: [PATCH] render: Avoid 0 or less animated cursors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Animated cursors use a series of cursors that the client can set. + +By default, the Xserver assumes at least one cursor is specified +while a client may actually pass no cursor at all. + +That causes an out-of-bound read creating the animated cursor and a +crash of the Xserver: + + | Invalid read of size 8 + | at 0x5323F4: AnimCursorCreate (animcur.c:325) + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | Address 0x59aa010 is 0 bytes after a block of size 0 alloc'd + | at 0x48468D3: reallocarray (vg_replace_malloc.c:1803) + | by 0x52D3DA: ProcRenderCreateAnimCursor (render.c:1802) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | + | Invalid read of size 2 + | at 0x5323F7: AnimCursorCreate (animcur.c:325) + | by 0x52D4C5: ProcRenderCreateAnimCursor (render.c:1817) + | by 0x52DC80: ProcRenderDispatch (render.c:1999) + | by 0x4A1E9D: Dispatch (dispatch.c:560) + | by 0x4B0169: dix_main (main.c:284) + | by 0x4287F5: main (stubmain.c:34) + | Address 0x8 is not stack'd, malloc'd or (recently) free'd + +To avoid the issue, check the number of cursors specified and return a +BadValue error in both the proc handler (early) and the animated cursor +creation (as this is a public function) if there is 0 or less cursor. + +CVE-2025-49175 + +This issue was discovered by Nils Emmerich and +reported by Julian Suleder via ERNW Vulnerability Disclosure. + +Signed-off-by: Olivier Fourdan +Reviewed-by: José Expósito +Part-of: + +--- + render/animcur.c | 3 +++ + render/render.c | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/render/animcur.c b/render/animcur.c +index ef27bda..77942d8 100644 +--- a/render/animcur.c ++++ b/render/animcur.c +@@ -304,6 +304,9 @@ AnimCursorCreate(CursorPtr *cursors, CARD32 *deltas, int ncursor, + int rc = BadAlloc, i; + AnimCurPtr ac; + ++ if (ncursor <= 0) ++ return BadValue; ++ + for (i = 0; i < screenInfo.numScreens; i++) + if (!GetAnimCurScreen(screenInfo.screens[i])) + return BadImplementation; +diff --git a/render/render.c b/render/render.c +index 5bc2a20..a8c2da0 100644 +--- a/render/render.c ++++ b/render/render.c +@@ -1795,6 +1795,8 @@ ProcRenderCreateAnimCursor(ClientPtr client) + ncursor = + (client->req_len - + (bytes_to_int32(sizeof(xRenderCreateAnimCursorReq)))) >> 1; ++ if (ncursor <= 0) ++ return BadValue; + cursors = xallocarray(ncursor, sizeof(CursorPtr) + sizeof(CARD32)); + if (!cursors) + return BadAlloc; +-- +2.43.0 + diff --git a/xorg-x11-server-xwayland.spec b/xorg-x11-server-xwayland.spec index c43195d..b259ca0 100644 --- a/xorg-x11-server-xwayland.spec +++ b/xorg-x11-server-xwayland.spec @@ -4,7 +4,7 @@ Summary: Xwayland Name: xorg-x11-server-Xwayland Version: 22.1.2 -Release: 6 +Release: 7 License: MIT URL: http://www.x.org Source0: https://www.x.org/pub/individual/xserver/%{pkgname}-%{version}.tar.xz @@ -20,7 +20,8 @@ Patch8: 0008-fix-CVE-2024-0229-1.patch Patch9: 0009-fix-CVE-2024-0229-2.patch Patch10: 0010-fix-CVE-2024-0229-3.patch Patch11: 0011-fix-CVE-2024-31083.patch -Patch12: CVE-2022-2320.patch +Patch12: 0012-fix-CVE-2022-2320.patch +Patch13: 0013-fix-CVE-2025-49175.patch Requires: xorg-x11-server-common Requires: libEGL @@ -121,6 +122,9 @@ rm -Rf $RPM_BUILD_ROOT%{_localstatedir}/lib/xkb %{_libdir}/pkgconfig/xwayland.pc %changelog +* Tue Sep 23 2025 Deyuan Fan - 22.1.2-7 +- fix CVE-2025-49175 + * Wed Jun 12 2024 technology208 - 22.1.2-6 - fix CVE-2022-2320 -- Gitee