xserver: Branch 'server-1.20-branch' - 3 commits

[GitLab Mirror]

 configure.ac                 |    6 +++---
 hw/xfree86/common/xf86Init.c |    8 ++++++--
 meson.build                  |    2 +-
 os/log.c                     |    2 ++
 4 files changed, 12 insertions(+), 6 deletions(-)

New commits:
commit 971d418113740cae2d7d393850bad4926d1a7e86
Author: Adam Jackson <ajax at redhat.com>
Date:   Thu Oct 25 09:03:18 2018 -0400

    xserver 1.20.3
    
    Signed-off-by: Adam Jackson <ajax at redhat.com>

diff --git a/configure.ac b/configure.ac
index 6a8668311..80f0ce785 100644
--- a/configure.ac
+++ b/configure.ac
@@ -26,9 +26,9 @@ dnl
 dnl Process this file with autoconf to create configure.
 
 AC_PREREQ(2.60)
-AC_INIT([xorg-server], 1.20.2, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
-RELEASE_DATE="2018-10-15"
-RELEASE_NAME="Tofu Biryani"
+AC_INIT([xorg-server], 1.20.3, [https://bugs.freedesktop.org/enter_bug.cgi?product=xorg], xorg-server)
+RELEASE_DATE="2018-10-25"
+RELEASE_NAME="Harissa Roasted Carrots"
 AC_CONFIG_SRCDIR([Makefile.am])
 AC_CONFIG_MACRO_DIR([m4])
 AM_INIT_AUTOMAKE([foreign dist-bzip2])
diff --git a/meson.build b/meson.build
index 291753d8d..ec9a24be6 100644
--- a/meson.build
+++ b/meson.build
@@ -3,7 +3,7 @@ project('xserver', 'c',
             'buildtype=debugoptimized',
             'c_std=gnu99',
         ],
-        version: '1.20.2',
+        version: '1.20.3',
         meson_version: '>= 0.42.0',
 )
 add_project_arguments('-DHAVE_DIX_CONFIG_H', language: 'c')
commit da15c7413916f754708c62c2089265528cd661e2
Author: Matthieu Herrb <matthieu at herrb.eu>
Date:   Tue Oct 23 21:29:09 2018 +0200

    LogFilePrep: add a comment to the unsafe format string.
    
    CVE-2018-14665 also made it possible to exploit this to access
    memory. With -logfile forbidden when running with elevated privileges
    this is no longer an issue.
    
    Signed-off-by: Matthieu Herrb <matthieu at herrb.eu>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    (cherry picked from commit 248d164eae27f1f310266d78e52f13f64362f81e)

diff --git a/os/log.c b/os/log.c
index a3b28ccb4..803639ef0 100644
--- a/os/log.c
+++ b/os/log.c
@@ -194,6 +194,8 @@ LogFilePrep(const char *fname, const char *backup, const char *idstring)
 {
     char *logFileName = NULL;
 
+    /* the format string below is controlled by the user,
+       this code should never be called with elevated privileges */
     if (asprintf(&logFileName, fname, idstring) == -1)
         FatalError("Cannot allocate space for the log file name\n");
 
commit 8a59e3b7dbb30532a7c3769c555e00d7c4301170
Author: Matthieu Herrb <matthieu at herrb.eu>
Date:   Tue Oct 23 21:29:08 2018 +0200

    Disable -logfile and -modulepath when running with elevated privileges
    
    Could cause privilege elevation and/or arbitrary files overwrite, when
    the X server is running with elevated privileges (ie when Xorg is
    installed with the setuid bit set and started by a non-root user).
    
    CVE-2018-14665
    
    Issue reported by Narendra Shinde and Red Hat.
    
    Signed-off-by: Matthieu Herrb <matthieu at herrb.eu>
    Reviewed-by: Alan Coopersmith <alan.coopersmith at oracle.com>
    Reviewed-by: Peter Hutterer <peter.hutterer at who-t.net>
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    (cherry picked from commit 50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e)

diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
index 3c5cc7097..cabf8716b 100644
--- a/hw/xfree86/common/xf86Init.c
+++ b/hw/xfree86/common/xf86Init.c
@@ -1027,14 +1027,18 @@ ddxProcessArgument(int argc, char **argv, int i)
     /* First the options that are not allowed with elevated privileges */
     if (!strcmp(argv[i], "-modulepath")) {
         CHECK_FOR_REQUIRED_ARGUMENT();
-        xf86CheckPrivs(argv[i], argv[i + 1]);
+        if (xf86PrivsElevated())
+              FatalError("\nInvalid argument -modulepath "
+                "with elevated privileges\n");
         xf86ModulePath = argv[i + 1];
         xf86ModPathFrom = X_CMDLINE;
         return 2;
     }
     if (!strcmp(argv[i], "-logfile")) {
         CHECK_FOR_REQUIRED_ARGUMENT();
-        xf86CheckPrivs(argv[i], argv[i + 1]);
+        if (xf86PrivsElevated())
+              FatalError("\nInvalid argument -logfile "
+                "with elevated privileges\n");
         xf86LogFile = argv[i + 1];
         xf86LogFileFrom = X_CMDLINE;
         return 2;