File U_bsc1216133-mi-reset-the-PointerWindows-refere... of Package xorg-x11-server.31718

Overview Repositories Revisions Requests Users Attributes Meta

File U_bsc1216133-mi-reset-the-PointerWindows-reference-on-screen-swit.patch of Package xorg-x11-server.31718

From 344bdc9b8075bc98ddad46439f04f17b8a681cc5 Mon Sep 17 00:00:00 2001
From: Peter Hutterer <peter.hutterer@who-t.net>
Date: Thu, 5 Oct 2023 12:19:45 +1000
Subject: [PATCH xserver] mi: reset the PointerWindows reference on screen
 switch

PointerWindows[] keeps a reference to the last window our sprite
entered - changes are usually handled by CheckMotion().

If we switch between screens via XWarpPointer our
dev->spriteInfo->sprite->win is set to the new screen's root window.
If there's another window at the cursor location CheckMotion() will
trigger the right enter/leave events later. If there is not, it skips
that process and we never trigger LeaveWindow() - PointerWindows[] for
the device still refers to the previous window.

If that window is destroyed we have a dangling reference that will
eventually cause a use-after-free bug when checking the window hierarchy
later.

To trigger this, we require:
- two protocol screens
- XWarpPointer to the other screen's root window
- XDestroyWindow before entering any other window

This is a niche bug so we hack around it by making sure we reset the
PointerWindows[] entry so we cannot have a dangling pointer. This
doesn't handle Enter/Leave events correctly but the previous code didn't
either.

CVE-2023-5380, ZDI-CAN-21608

This vulnerability was discovered by:
Sri working with Trend Micro Zero Day Initiative

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
---
 dix/enterleave.h   |  2 --
 include/eventstr.h |  3 +++
 mi/mipointer.c     | 17 +++++++++++++++--
 3 files changed, 18 insertions(+), 4 deletions(-)

Index: dix/enterleave.h
===================================================================
--- dix/enterleave.h.orig
+++ dix/enterleave.h
@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPt
 
 extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
 
-extern void LeaveWindow(DeviceIntPtr dev);
-
 extern void CoreFocusEvent(DeviceIntPtr kbd,
                            int type, int mode, int detail, WindowPtr pWin);
 
Index: include/eventstr.h
===================================================================
--- include/eventstr.h.orig
+++ include/eventstr.h
@@ -296,4 +296,7 @@ union _InternalEvent {
 #endif
 };
 
+extern void
+LeaveWindow(DeviceIntPtr dev);
+
 #endif
Index: mi/mipointer.c
===================================================================
--- mi/mipointer.c.orig
+++ mi/mipointer.c
@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, S
 #ifdef PANORAMIX
         && noPanoramiXExtension
 #endif
-        )
-        UpdateSpriteForScreen(pDev, pScreen);
+        ) {
+            DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
+            /* Hack for CVE-2023-5380: if we're moving
+             * screens PointerWindows[] keeps referring to the
+             * old window. If that gets destroyed we have a UAF
+             * bug later. Only happens when jumping from a window
+             * to the root window on the other screen.
+             * Enter/Leave events are incorrect for that case but
+             * too niche to fix.
+             */
+            LeaveWindow(pDev);
+            if (master)
+                LeaveWindow(master);
+            UpdateSpriteForScreen(pDev, pScreen);
+    }
 }
 
 /**

Places

File U_bsc1216133-mi-reset-the-PointerWindows-reference-on-screen-swit.patch of Package xorg-x11-server.31718

Places