mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2026-06-07 00:38:20 +02:00
ecc634f1b2
CreateSaverWindow stores pPriv (the ScreenSaverScreenPrivatePtr) in a local variable via the SetupScreen macro at function entry. When an existing saver window is being replaced, the function sets pPriv->hasWindow = FALSE and calls CheckScreenPrivate(). If at this point pPriv->attr is NULL (cleared by a prior UnsetAttributes call), pPriv->events is NULL, and pPriv->installedMap is None, then CheckScreenPrivate determines the screen private is unused, frees it, and sets the screen private pointer to NULL. The function then continues to dereference the now-freed pPriv on the very next line (pPriv->attr), resulting in a use-after-free. On glibc 2.34+, the tcache key at offset 8 within the freed block makes pPriv->attr appear non-NULL, causing the function to continue operating on garbage data and eventually crash. The attack sequence is: 1. SetAttributes (creates pPriv with pPriv->attr set) 2. ForceScreenSaver(Active) (creates saver window, pPriv->hasWindow=TRUE) 3. UnsetAttributes (sets pPriv->attr = NULL) 4. ForceScreenSaver(Active) (re-enters CreateSaverWindow → UAF) Fix by re-fetching pPriv from the screen private after CheckScreenPrivate returns, so the subsequent NULL check correctly detects the freed state. ScreenSaverFreeAttr has the same pattern, force pPriv to NULL there too even though it has no real effect. This vulnerability was discovered by: Anonymous working with TrendAI Zero Day Initiative ZDI-CAN-30168 Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228> |
||
|---|---|---|
| .. | ||
| bigreq.c | ||
| dpms.c | ||
| dpmsproc.h | ||
| geext.c | ||
| geext.h | ||
| geint.h | ||
| hashtable.c | ||
| hashtable.h | ||
| meson.build | ||
| panoramiX.c | ||
| panoramiX.h | ||
| panoramiXh.h | ||
| panoramiXprocs.c | ||
| panoramiXsrv.h | ||
| panoramiXSwap.c | ||
| saver.c | ||
| security.c | ||
| securitysrv.h | ||
| shape.c | ||
| shm.c | ||
| shmint.h | ||
| sleepuntil.c | ||
| sleepuntil.h | ||
| sync.c | ||
| syncsdk.h | ||
| syncsrv.h | ||
| vidmode.c | ||
| xace.c | ||
| xace.h | ||
| xacestr.h | ||
| xcmisc.c | ||
| xf86bigfont.c | ||
| xf86bigfontsrv.h | ||
| xres.c | ||
| xselinux.h | ||
| xselinux_ext.c | ||
| xselinux_hooks.c | ||
| xselinux_label.c | ||
| xselinuxint.h | ||
| xtest.c | ||
| xvdisp.c | ||
| xvdisp.h | ||
| xvdix.h | ||
| xvmain.c | ||
| xvmc.c | ||
| xvmcext.h | ||