[crux-commits] ports/xorg (3.6): [notify] xorg-server: Fix for CVE-2020-14347.

crux at crux.nu crux at crux.nu
Sat Aug 1 14:17:40 UTC 2020


commit 3a026cd9c14551db0164ea400ac6b799bb28e945
Author: Fredrik Rinnestam <fredrik at crux.nu>
Date:   Sat Aug 1 16:16:55 2020 +0200

    [notify] xorg-server: Fix for CVE-2020-14347.
    
    X.Org security advisory: July 31, 2020
    
    X Server Pixel Data Uninitialized Memory Information Disclosure
    ===============================================================
    
    CVE-2020-14347
    
    Allocation for pixmap data in AllocatePixmap() does not initialize the
    memory in xserver, it leads to leak uninitialize heap memory to
    clients. When the X server runs with elevated privileges.
    
    This flaw can lead to ASLR bypass, which when combined with other
    flaws (known/unknown) could lead to lead to privilege elevation in the
    client.

diff --git a/xorg-server/.signature b/xorg-server/.signature
index 032a5a98..c019d3b2 100644
--- a/xorg-server/.signature
+++ b/xorg-server/.signature
@@ -1,5 +1,6 @@
 untrusted comment: verify with /etc/ports/xorg.pub
-RWTSGWF5Q7TndDg1Anu2ouJAb7KUFEPSKqh472+MCvxVBHiDcuPT93VorAqVbFCmcpsSEI4l73lkhcm04cQvMdHdNpknkA/mJwA=
-SHA256 (Pkgfile) = d051963ce7c6250aabc5c609700c293f4c4a93df5ce436958f6c729734b14a97
+RWTSGWF5Q7TndO6ucO1zqkMnuHKTjsfLzAeeCsVuNPNeyBRjpEFi1wF2R38IGZBO5CQtDCF+UmiGXmKiKjs1LE3agFVeTjhh9A4=
+SHA256 (Pkgfile) = 3b300ca40982d994f747b1832e1bb939677aff193dd9a969ded6ce4b3ec453b6
 SHA256 (.footprint) = d159a275a4868001332954580ab4f70976c97a80334b157023935b36722e50cd
 SHA256 (xorg-server-1.20.8.tar.bz2) = d17b646bee4ba0fb7850c1cc55b18e3e8513ed5c02bdf38da7e107f84e2d0146
+SHA256 (CVE-2020-14347.patch) = 8ec70385e7e8195c27db0a86c851b7505249ec4ef167e1b0d171b187bc837604
diff --git a/xorg-server/CVE-2020-14347.patch b/xorg-server/CVE-2020-14347.patch
new file mode 100644
index 00000000..7adec3a1
--- /dev/null
+++ b/xorg-server/CVE-2020-14347.patch
@@ -0,0 +1,12 @@
+diff --git a/dix/pixmap.c b/dix/pixmap.c
+index 1186d7dbb..5a0146bbb 100644
+--- a/dix/pixmap.c
++++ b/dix/pixmap.c
+@@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
+     if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize)
+         return NullPixmap;
+ 
+-    pPixmap = malloc(pScreen->totalPixmapSize + pixDataSize);
++    pPixmap = calloc(1, pScreen->totalPixmapSize + pixDataSize);
+     if (!pPixmap)
+         return NullPixmap;
diff --git a/xorg-server/Pkgfile b/xorg-server/Pkgfile
index 5e908298..d8513c3c 100644
--- a/xorg-server/Pkgfile
+++ b/xorg-server/Pkgfile
@@ -5,12 +5,15 @@
 
 name=xorg-server
 version=1.20.8
-release=1
-source=(https://www.x.org/releases/individual/xserver/$name-$version.tar.bz2)
+release=2
+source=(https://www.x.org/releases/individual/xserver/$name-$version.tar.bz2 \
+	CVE-2020-14347.patch)
 
 build() {
     cd $name-$version
 
+    patch -p1 -i $SRC/CVE-2020-14347.patch
+
     ./configure --prefix=/usr \
                 --localstatedir=/var \
                 --with-fontrootdir=/usr/share/fonts/X11 \


More information about the crux-commits mailing list