fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-01-03 15:10:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

sync: Do not let sync objects uninitialized

Browse source 
When changing an alarm, the change mask values are evaluated one after
the other, changing the trigger values as requested and eventually,
SyncInitTrigger() is called.

SyncInitTrigger() will evaluate the XSyncCACounter first and may free
the existing sync object.

Other changes are then evaluated and may trigger an error and an early
return, not adding the new sync object.

This can be used to cause a use after free when the alarm eventually
triggers.

To avoid the issue, delete the existing sync object as late as possible
only once we are sure that no further error will cause an early exit.

CVE-2025-26601, ZDI-CAN-25870

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 16a1242d0f)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
This commit is contained in:
Olivier Fourdan 2025-01-20 16:52:01 +01:00
parent 826cef825f
commit e708ad0217
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
Xext/sync.c
View file

@ -329,11 +329,6 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
client->errorValue = syncObject;
return rc;
}
if (pSync != pTrigger->pSync) { /* new counter for trigger */
SyncDeleteTriggerFromSyncObject(pTrigger);
pTrigger->pSync = pSync;
newSyncObject = TRUE;
}
}
/* if system counter, ask it what the current value is */
@ -401,6 +396,14 @@ SyncInitTrigger(ClientPtr client, SyncTrigger * pTrigger, XID syncObject,
}
}
if (changes & XSyncCACounter) {
if (pSync != pTrigger->pSync) { /* new counter for trigger */
SyncDeleteTriggerFromSyncObject(pTrigger);
pTrigger->pSync = pSync;
newSyncObject = TRUE;
}
}
/* we wait until we're sure there are no errors before registering
* a new counter on a trigger
*/