Skip to content
Snippets Groups Projects
Select Git revision
0 results
Search by author
  • Any Author
0 authors
  1. Feb 26, 2025
  3. Feb 25, 2025
    • Olivier Fourdan's avatar
      dix: Dequeue pending events on frozen device on removal · 6e0f332b
      Olivier Fourdan authored 
      
When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed.

As a result, replaying the events will cause a use after free.

To avoid the issue, make sure to dequeue and free any pending events on
a frozen device when removed.

CVE-2025-26600, ZDI-CAN-25871

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: default avatarOlivier Fourdan <ofourdan@redhat.com>
Reviewed-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Part-of: <!1828>
      6e0f332b
    • Peter Hutterer's avatar
      dix: keep a ref to the rootCursor · b0a09ba6
      Peter Hutterer authored and Olivier Fourdan's avatar Olivier Fourdan committed 
      
CreateCursor returns a cursor with refcount 1 - that refcount is used by
the resource system, any caller needs to call RefCursor to get their own
reference. That happens correctly for normal cursors but for our
rootCursor we keep a variable to the cursor despite not having a ref for
ourselves.

Fix this by reffing/unreffing the rootCursor to ensure our pointer is
valid.

Related to CVE-2025-26594, ZDI-CAN-25544

Reviewed-by: default avatarOlivier Fourdan <ofourdan@redhat.com>
Part-of: <!1828>
      b0a09ba6
    • Olivier Fourdan's avatar
      Cursor: Refuse to free the root cursor · 01642f26
      Olivier Fourdan authored 
      
If a cursor reference count drops to 0, the cursor is freed.

The root cursor however is referenced with a specific global variable,
and when the root cursor is freed, the global variable may still point
to freed memory.

Make sure to prevent the rootCursor from being explicitly freed by a
client.

CVE-2025-26594, ZDI-CAN-25544

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

v2: Explicitly forbid XFreeCursor() on the root cursor (Peter Hutterer
<peter.hutterer@who-t.net>)
v3: Return BadCursor instead of BadValue (Michel Dänzer
<michel@daenzer.net>)

Signed-off-by: default avatarOlivier Fourdan <ofourdan@redhat.com>
Suggested-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Part-of: <!1828>
      01642f26
  5. Feb 24, 2025
  7. Feb 23, 2025
  9. Feb 18, 2025
  11. Feb 17, 2025
  13. Feb 12, 2025
  15. Feb 11, 2025
  17. Feb 06, 2025
  19. Oct 28, 2024
    • Alan Coopersmith's avatar
      dix: limit checks to MAX_VALUATORS when generating Xi events · b65eea43
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      
Previously, it was looping through sizeof(ev->valuators.mask) * 8
valuators, where valuators.mask is defined as an array of
(MAX_VALUATORS + 7) / 8 entries.  Since MAX_VALUATORS is defined as 36,
this made it actually loop through 40 entries.  The last 4 bits in this
array should never be set, so we should never access memory outside the
bounds of the arrays defined to be exactly MAX_VALUATORS in length, but
we can make the static analyzer happier and not waste time checking bits
that should never be set.

Found by Oracle Parfait 13.3 static analyzer:

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 741 of dix/eventconvert.c in function 'eventToDeviceEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 808 of dix/eventconvert.c in function 'eventToRawEvent'.

   Read outside array bounds [read-outside-array-bounds]:
      In array dereference of ev->valuators.data_raw[i] with index i
      Array size is 36 elements (of 8 bytes each), index >= 0 and index <= 39
        at line 809 of dix/eventconvert.c in function 'eventToRawEvent'.

Fixes: b2ba77ba ("dix: add EventToXI2 and GetXI2Type.")
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      b65eea43
    • Alan Coopersmith's avatar
      dix: fix button offset when generating DeviceButtonStateNotify events · 4b073d65
      Alan Coopersmith authored and Marge Bot's avatar Marge Bot committed 
      
Found by Oracle Parfait 13.3 static analyzer:
   Buffer Overflow in STD C function [buffer-overflow-call-stdc]:
      Buffer overflow in call to memcpy. Buffer &bev->buttons[4] of
       size 24 is written at an offset of 28
      Array size is 28 bytes, index is 32
        at line 743 of dix/enterleave.c in function
	 'DeliverStateNotifyEvent'.

Fixes: a85f0d6b ("Xi: fix use of button->down - bitflags instead of int arrays.")
Reviewed-by: default avatarPeter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: default avatarAlan Coopersmith <alan.coopersmith@oracle.com>
Part-of: <!1730>
      4b073d65
  21. Oct 26, 2024
  23. Oct 10, 2024
  25. Sep 08, 2024