From 70772037189206a9708a478d575d1711a559204b Mon Sep 17 00:00:00 2001 From: liweiganga Date: Fri, 17 Feb 2023 16:39:59 +0800 Subject: [PATCH 1/3] fix CVE-2023-0494 --- backport-CVE-2023-0494.patch | 28 ++++++++++++++++++++++++++++ xorg-x11-server.spec | 6 +++++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-0494.patch diff --git a/backport-CVE-2023-0494.patch b/backport-CVE-2023-0494.patch new file mode 100644 index 0000000..3e13180 --- /dev/null +++ b/backport-CVE-2023-0494.patch @@ -0,0 +1,28 @@ +From 4005f77c03f67f1527519969b047c599cba32e36 Mon Sep 17 00:00:00 2001 +From: rpm-build +Date: Fri, 17 Feb 2023 16:34:39 +0800 +Subject: [PATCH] fix CVE-2023-0494 + +--- + Xi/exevents.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/Xi/exevents.c b/Xi/exevents.c +index 659816a..0cb8d78 100644 +--- a/Xi/exevents.c ++++ b/Xi/exevents.c +@@ -575,8 +575,10 @@ DeepCopyPointerClasses(DeviceIntPtr from, DeviceIntPtr to) + memcpy(to->button->xkb_acts, from->button->xkb_acts, + sizeof(XkbAction)); + } +- else ++ else { + free(to->button->xkb_acts); ++ to->button->xkb_acts = NULL; ++ } + + memcpy(to->button->labels, from->button->labels, + from->button->numButtons * sizeof(Atom)); +-- +2.20.1 + diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index d20334e..25da023 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -16,7 +16,7 @@ Name: xorg-x11-server Version: 1.20.11 -Release: 15 +Release: 16 Summary: X.Org X11 X server License: MIT and GPLv2 URL: https://www.x.org @@ -102,6 +102,7 @@ Patch6015: backport-CVE-2022-46343.patch Patch6016: backport-Xi-return-an-error-from-XI-property-changes-if-verification-failed.patch Patch6017: backport-CVE-2022-46344.patch Patch6018: backport-CVE-2022-4283.patch +Patch6019: backport-CVE-2023-0494.patch BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc BuildRequires: systemtap-sdt-devel libtool pkgconfig @@ -445,6 +446,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %{_mandir}/man*/* %changelog +* Fri Feb 17 2023 liweiganga -1.20.11-16 +- fix CVE-2023-0494 + * Tue Jan 10 2023 zhouwenpei -1.20.11-15 - add missing patches -- Gitee From 97a499ac0db1dce9d69c6e93f3adebae537c5d3e Mon Sep 17 00:00:00 2001 From: liweiganga Date: Mon, 20 Mar 2023 10:00:04 +0800 Subject: [PATCH 2/3] feat: all man files is provided by help package --- xorg-x11-server.spec | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 25da023..fc7affd 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -16,7 +16,7 @@ Name: xorg-x11-server Version: 1.20.11 -Release: 16 +Release: 17 Summary: X.Org X11 X server License: MIT and GPLv2 URL: https://www.x.org @@ -405,7 +405,6 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %files Xnest %{_bindir}/Xnest -%{_mandir}/man1/Xnest.1* %files Xdmx %{_bindir}/Xdmx @@ -424,11 +423,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %files Xvfb %{_bindir}/Xvfb %{_bindir}/xvfb-run -%{_mandir}/man1/Xvfb.1* %files Xephyr %{_bindir}/Xephyr -%{_mandir}/man1/Xephyr.1* %files source %{xserver_source_dir} @@ -446,6 +443,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %{_mandir}/man*/* %changelog +* Mon Mar 20 2023 liweiganga -1.20.11-17 +- feat: all man files is provided by help package + * Fri Feb 17 2023 liweiganga -1.20.11-16 - fix CVE-2023-0494 -- Gitee From d5f00cb21453aa9c424393aa97c2a8a8ad8aae7e Mon Sep 17 00:00:00 2001 From: liweiganga Date: Wed, 12 Apr 2023 17:03:23 +0800 Subject: [PATCH 3/3] fix: CVE-2023-1393 --- backport-CVE-2023-1393.patch | 42 ++++++++++++++++++++++++++++++++++++ xorg-x11-server.spec | 6 +++++- 2 files changed, 47 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-1393.patch diff --git a/backport-CVE-2023-1393.patch b/backport-CVE-2023-1393.patch new file mode 100644 index 0000000..520108a --- /dev/null +++ b/backport-CVE-2023-1393.patch @@ -0,0 +1,42 @@ +From 26ef545b3502f61ca722a7a3373507e88ef64110 Mon Sep 17 00:00:00 2001 +From: Olivier Fourdan +Date: Mon, 13 Mar 2023 11:08:47 +0100 +Subject: [PATCH xserver] composite: Fix use-after-free of the COW + +ZDI-CAN-19866/CVE-2023-1393 + +If a client explicitly destroys the compositor overlay window (aka COW), +we would leave a dangling pointer to that window in the CompScreen +structure, which will trigger a use-after-free later. + +Make sure to clear the CompScreen pointer to the COW when the latter gets +destroyed explicitly by the client. + +This vulnerability was discovered by: +Jan-Niklas Sohn working with Trend Micro Zero Day Initiative + +Signed-off-by: Olivier Fourdan +Reviewed-by: Adam Jackson +--- + composite/compwindow.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/composite/compwindow.c b/composite/compwindow.c +index 4e2494b86..b30da589e 100644 +--- a/composite/compwindow.c ++++ b/composite/compwindow.c +@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin) + ret = (*pScreen->DestroyWindow) (pWin); + cs->DestroyWindow = pScreen->DestroyWindow; + pScreen->DestroyWindow = compDestroyWindow; ++ ++ /* Did we just destroy the overlay window? */ ++ if (pWin == cs->pOverlayWin) ++ cs->pOverlayWin = NULL; ++ + /* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/ + return ret; + } +-- +2.40.0 + diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index fc7affd..b4dd754 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -16,7 +16,7 @@ Name: xorg-x11-server Version: 1.20.11 -Release: 17 +Release: 18 Summary: X.Org X11 X server License: MIT and GPLv2 URL: https://www.x.org @@ -103,6 +103,7 @@ Patch6016: backport-Xi-return-an-error-from-XI-property-changes-if-verification- Patch6017: backport-CVE-2022-46344.patch Patch6018: backport-CVE-2022-4283.patch Patch6019: backport-CVE-2023-0494.patch +Patch6020: backport-CVE-2023-1393.patch BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc BuildRequires: systemtap-sdt-devel libtool pkgconfig @@ -443,6 +444,9 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete %{_mandir}/man*/* %changelog +* Wed Apr 12 2023 liweiganga -1.20.11-18 +- fix CVE-2023-1393 + * Mon Mar 20 2023 liweiganga -1.20.11-17 - feat: all man files is provided by help package -- Gitee