wok-current view xorg-server/stuff/CVE-2024-0408.patch @ rev 25695
Up linux 5.10.214, Patch xorg-server (CVE-2024-31080, CVE-2024-31081, CVE-2024-31082, CVE-2024-31083)
| author | Stanislas Leduc <shann@slitaz.org> |
|---|---|
| date | Thu Apr 04 08:53:51 2024 +0000 (5 months ago) |
| parents | |
| children |
line source
1 From e5e8586a12a3ec915673edffa10dc8fe5e15dac3 Mon Sep 17 00:00:00 2001
2 From: Olivier Fourdan <ofourdan@redhat.com>
3 Date: Wed, 6 Dec 2023 12:09:41 +0100
4 Subject: [PATCH] glx: Call XACE hooks on the GLX buffer
6 The XSELINUX code will label resources at creation by checking the
7 access mode. When the access mode is DixCreateAccess, it will call the
8 function to label the new resource SELinuxLabelResource().
10 However, GLX buffers do not go through the XACE hooks when created,
11 hence leaving the resource actually unlabeled.
13 When, later, the client tries to create another resource using that
14 drawable (like a GC for example), the XSELINUX code would try to use
15 the security ID of that object which has never been labeled, get a NULL
16 pointer and crash when checking whether the requested permissions are
17 granted for subject security ID.
19 To avoid the issue, make sure to call the XACE hooks when creating the
20 GLX buffers.
22 Credit goes to Donn Seeley <donn@xmission.com> for providing the patch.
24 CVE-2024-0408
26 Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
27 Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
28 ---
29 glx/glxcmds.c | 8 ++++++++
30 1 file changed, 8 insertions(+)
32 diff --git a/glx/glxcmds.c b/glx/glxcmds.c
33 index fc26a2e345..1e46d0c723 100644
34 --- a/glx/glxcmds.c
35 +++ b/glx/glxcmds.c
36 @@ -48,6 +48,7 @@
37 #include "indirect_util.h"
38 #include "protocol-versions.h"
39 #include "glxvndabi.h"
40 +#include "xace.h"
42 static char GLXServerVendorName[] = "SGI";
44 @@ -1392,6 +1393,13 @@ DoCreatePbuffer(ClientPtr client, int screenNum, XID fbconfigId,
45 if (!pPixmap)
46 return BadAlloc;
48 + err = XaceHook(XACE_RESOURCE_ACCESS, client, glxDrawableId, RT_PIXMAP,
49 + pPixmap, RT_NONE, NULL, DixCreateAccess);
50 + if (err != Success) {
51 + (*pGlxScreen->pScreen->DestroyPixmap) (pPixmap);
52 + return err;
53 + }
54 +
55 /* Assign the pixmap the same id as the pbuffer and add it as a
56 * resource so it and the DRI2 drawable will be reclaimed when the
57 * pbuffer is destroyed. */
58 --
59 GitLab