fdo-mirrors/xserver
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/xorg/xserver.git synced 2026-01-09 11:10:17 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
xserver/dix
History
Olivier Fourdan 826cef825f dix: Dequeue pending events on frozen device on removal 
When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed.

As a result, replaying the events will cause a use after free.

To avoid the issue, make sure to dequeue and free any pending events on
a frozen device when removed.

CVE-2025-26600, ZDI-CAN-25871

This vulnerability was discovered by:
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit 6e0f332ba4)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1830>
2025-02-25 19:36:29 +01:00
..
.gitignore Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
atom.c atom: make FreeAtom static 2015-07-08 16:41:29 -04:00
buildatoms XFree86 4.3.0.1 2003-11-14 16:49:22 +00:00
BuiltInAtoms R6.6 is the Xorg base-line 2003-11-14 15:54:54 +00:00
colormap.c dix: FindBestPixel: fix implicit fallthrough warning 2024-10-11 00:18:05 +00:00
cursor.c dix: Remove -fn and -fc options to set default text/cursor fonts 2019-10-30 16:17:04 +00:00
devices.c dix: Dequeue pending events on frozen device on removal 2025-02-25 19:36:29 +01:00
dispatch.c Cursor: Refuse to free the root cursor 2025-02-25 19:36:29 +01:00
dispatch.h Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
dixfonts.c dix: SetFontPath: don't set errorValue on Success 2024-10-11 00:18:05 +00:00
dixutils.c os: Don't crash in AttendClient if the client is gone 2019-11-19 10:15:05 -08:00
enterleave.c dix: fix button offset when generating DeviceButtonStateNotify events 2025-02-05 15:02:23 +01:00
enterleave.h mi: reset the PointerWindows reference on screen switch 2023-10-25 10:51:18 +10:00
eventconvert.c dix: limit checks to MAX_VALUATORS when generating Xi events 2025-02-05 15:02:23 +01:00
events.c dix: Use CopyPartialInternalEvent in EnqueueEvent 2023-02-07 10:21:52 +10:00
extension.c dix: Allow an extension to disable itself 2018-04-24 14:36:04 -04:00
gc.c dix: CreateScratchGC: avoid dereference of pointer we just set to NULL 2024-10-11 00:18:05 +00:00
gestures.c Implement gesture processing logic 2021-05-30 13:26:42 +03:00
getevents.c touchevents: set the screen pointer after checking the device is enabled 2021-09-07 16:58:10 +02:00
globals.c include: Remove now-empty site.h 2019-10-30 16:17:04 +00:00
glyphcurs.c Let calloc handle multiplication 2015-04-21 16:57:07 -07:00
grabs.c xi: Implement grab support for new gesture event types 2021-05-30 13:26:32 +03:00
initatoms.c Introduce a consistent coding style 2012-03-21 13:54:42 -07:00
inpututils.c Implement gesture processing logic 2021-05-30 13:26:42 +03:00
main.c dix: keep a ref to the rootCursor 2025-02-25 19:36:29 +01:00
Makefile.am dix: Implement internal gesture state handling 2021-05-30 13:26:39 +03:00
meson.build dix: Implement internal gesture state handling 2021-05-30 13:26:39 +03:00
pixmap.c fix for ZDI-11426 2020-07-31 14:51:23 +00:00
privates.c dix/privates.c: Avoid undefined behaviour after realloc() 2021-10-08 21:38:01 +03:00
property.c dix: ProcListProperties: skip unneeded work if numProps is 0 2024-10-11 00:18:05 +00:00
protocol.txt protocol.txt: add GLX req. 35 - SetClientInfo2ARB 2018-02-27 13:08:35 -05:00
ptrveloc.c dix: InitPredictableAccelerationScheme: avoid memory leak on failure 2024-10-11 00:18:05 +00:00
region.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
registry.c Build required portions of registry.c automatically [v2] 2014-09-18 15:29:29 -07:00
resource.c dix: HashResourceID: use unsigned integers for bit shifting 2024-10-11 00:18:05 +00:00
selection.c dix: Push UpdateCurrentTimeIf down out of the main loop 2016-05-04 10:58:01 -04:00
stubmain.c Allow DDX to provide a main() 2013-07-23 23:56:58 +01:00
swaprep.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00
swapreq.c dix: Disallow GenericEvent in SendEvent request. 2017-06-19 11:58:50 +10:00
tables.c Drop trailing whitespaces 2014-11-12 10:25:00 +10:00
touch.c xwayland: add -noTouchPointerEmulation 2021-09-06 21:19:46 +00:00
window.c Fix spelling/wording issues 2020-07-05 13:07:33 -07:00