xorg-server-21.1.11

[Xi Ruoyao]

New patch version.

[Xi Ruoyao]

It contains 6 CVE fixes: ​https://lists.x.org/archives/xorg/2024-January/061525.html.

[Douglas R. Reno]

We're only vulnerable to 4 of these issues, the other two require SELinux.

1) CVE-2023-6816: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer

Introduced in: xorg-server-1.13.0 (2012)
Fixed in: xorg-server-21.1.11 and xwayland-23.2.4
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
each logical button currently down. Buttons can be arbitrarily mapped to
any value up to 255 but the X.Org Server was only allocating space for the
device's number of buttons, leading to a heap overflow if a bigger value
was used.

xorg-server-21.1.11 and xwayland-23.2.4 have been patched to fix this issue.


2) CVE-2024-0229: Reattaching to different master device may lead to out-of-bounds memory access

Introduced in: xorg-server-1.1.1 (2006)
Fixed in: xorg-server-21.1.11 and xwayland-23.2.4
Fixes:
  - https://gitlab.freedesktop.org/xorg/xserver/-/commit/ece23be888a93b741aa1209d1dbf64636109d6a5
  - https://gitlab.freedesktop.org/xorg/xserver/-/commit/219c54b8a3337456ce5270ded6a67bcde53553d5
  - https://gitlab.freedesktop.org/xorg/xserver/-/commit/df3c65706eb169d5938df0052059f3e0d5981b74
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

If a device has both a button class and a key class and numButtons is
zero, we can get an out-of-bounds write due to event under-allocation in
the DeliverStateNotifyEvent function.

xorg-server-21.1.11 and xwayland-23.2.4 have been patched to fix this issue.


3) CVE-2024-21885: Heap buffer overflow in XISendDeviceHierarchyEvent

Introduced in: xorg-server-1.10.0 (2011)
Fixed in: xorg-server-21.1.11 and xwayland-23.2.4
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The XISendDeviceHierarchyEvent() function allocates space to store up
to MAXDEVICES (256) xXIHierarchyInfo structures in info.

If a device with a given ID was removed and a new device with the same
ID added both in the same operation, the single device ID will lead to
two info structures being written to info.

Since this case can occur for every device ID at once, a total of two
times MAXDEVICES info structures might be written to the allocation,
leading to a heap buffer overflow.

xorg-server-21.1.11 and xwayland-23.2.4 have been patched to fix this issue.


4) CVE-2024-21886: Heap buffer overflow in DisableDevice

Introduced in: xorg-server-1.13.0 (2012)
Fixed in: xorg-server-21.1.11 and xwayland-23.2.4
Fixes:
  - https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b
  - https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The DisableDevice() function is called whenever an enabled device
is disabled and it moves the device from the inputInfo.devices linked
list to the inputInfo.off_devices linked list.

However, its link/unlink operation has an issue during the recursive
call to DisableDevice() due to the prev pointer pointing to a
removed device.

This issue leads to a length mismatch between the total number of
devices and the number of device in the list, leading to a heap
overflow and, possibly, to local privilege escalation.

xorg-server-21.1.11 and xwayland-23.2.4 have been patched to fix this issue.

[Douglas R. Reno]

Release notes:

This release contains fixes for the issues reported in today's security
advisory: https://lists.x.org/archives/xorg/2024-January/061525.html

* CVE-2023-6816
* CVE-2024-0229
* CVE-2024-21885
* CVE-2024-21886
* CVE-2024-0408
* CVE-2024-0409

Additionally, it also contains a fix for XRandR to allow for multiple virtual
monitors on a physical display.

José Expósito (2):
      Xi: do not keep linked list pointer during recursion
      xserver 21.1.11

Michael Wyraz (1):
      Removing the code that deletes an existing monitor in RRMonitorAdd

Olivier Fourdan (2):
      glx: Call XACE hooks on the GLX buffer
      ephyr,xwayland: Use the proper private key for cursor

Peter Hutterer (6):
      dix: allocate enough space for logical button maps
      dix: Allocate sufficient xEvents for our DeviceStateNotify
      dix: fix DeviceStateNotify event calculation
      Xi: when creating a new ButtonClass, set the number of buttons
      Xi: flush hierarchy events after adding/removing master devices
      dix: when disabling a master, float disabled slaved devices too

[Douglas R. Reno]

I will need to update the patch to remove the hunk for meson.build - it's been applied upstream now

[Douglas R. Reno]

Fixed at a278ddb11c7126d568063f5599b5ff6bda16be34

SA-12.0-071 issued