xserver: Branch 'master' - 2 commits
GitLab Mirror
gitlab-mirror at kemper.freedesktop.org
Thu Oct 25 14:07:59 UTC 2018
hw/xfree86/common/xf86Init.c | 8 ++++++--
os/log.c | 2 ++
2 files changed, 8 insertions(+), 2 deletions(-)
New commits:
commit 248d164eae27f1f310266d78e52f13f64362f81e
Author: Matthieu Herrb <matthieu at herrb.eu>
Date: Tue Oct 23 21:29:09 2018 +0200
LogFilePrep: add a comment to the unsafe format string.
CVE-2018-14665 also made it possible to exploit this to access
memory. With -logfile forbidden when running with elevated privileges
this is no longer an issue.
Signed-off-by: Matthieu Herrb <matthieu at herrb.eu>
Reviewed-by: Adam Jackson <ajax at redhat.com>
diff --git a/os/log.c b/os/log.c
index 8576955fc..fd433e62f 100644
--- a/os/log.c
+++ b/os/log.c
@@ -194,6 +194,8 @@ LogFilePrep(const char *fname, const char *backup, const char *idstring)
{
char *logFileName = NULL;
+ /* the format string below is controlled by the user,
+ this code should never be called with elevated privileges */
if (asprintf(&logFileName, fname, idstring) == -1)
FatalError("Cannot allocate space for the log file name\n");
commit 50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e
Author: Matthieu Herrb <matthieu at herrb.eu>
Date: Tue Oct 23 21:29:08 2018 +0200
Disable -logfile and -modulepath when running with elevated privileges
Could cause privilege elevation and/or arbitrary files overwrite, when
the X server is running with elevated privileges (ie when Xorg is
installed with the setuid bit set and started by a non-root user).
CVE-2018-14665
Issue reported by Narendra Shinde and Red Hat.
Signed-off-by: Matthieu Herrb <matthieu at herrb.eu>
Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
Reviewed-by: Adam Jackson <ajax at redhat.com>
diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index 6c25eda73..0f57efa86 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -935,14 +935,18 @@ ddxProcessArgument(int argc, char **argv, int i)
/* First the options that are not allowed with elevated privileges */
if (!strcmp(argv[i], "-modulepath")) {
CHECK_FOR_REQUIRED_ARGUMENT();
- xf86CheckPrivs(argv[i], argv[i + 1]);
+ if (xf86PrivsElevated())
+ FatalError("\nInvalid argument -modulepath "
+ "with elevated privileges\n");
xf86ModulePath = argv[i + 1];
xf86ModPathFrom = X_CMDLINE;
return 2;
}
if (!strcmp(argv[i], "-logfile")) {
CHECK_FOR_REQUIRED_ARGUMENT();
- xf86CheckPrivs(argv[i], argv[i + 1]);
+ if (xf86PrivsElevated())
+ FatalError("\nInvalid argument -logfile "
+ "with elevated privileges\n");
xf86LogFile = argv[i + 1];
xf86LogFileFrom = X_CMDLINE;
return 2;
More information about the xorg-commit
mailing list