mirror of
https://gitlab.freedesktop.org/xorg/xserver.git
synced 2025-12-26 10:00:05 +01:00
3e290b3c7c
PointerWindows[] keeps a reference to the last window our sprite
entered - changes are usually handled by CheckMotion().
If we switch between screens via XWarpPointer our
dev->spriteInfo->sprite->win is set to the new screen's root window.
If there's another window at the cursor location CheckMotion() will
trigger the right enter/leave events later. If there is not, it skips
that process and we never trigger LeaveWindow() - PointerWindows[] for
the device still refers to the previous window.
If that window is destroyed we have a dangling reference that will
eventually cause a use-after-free bug when checking the window hierarchy
later.
To trigger this, we require:
- two protocol screens
- XWarpPointer to the other screen's root window
- XDestroyWindow before entering any other window
This is a niche bug so we hack around it by making sure we reset the
PointerWindows[] entry so we cannot have a dangling pointer. This
doesn't handle Enter/Leave events correctly but the previous code didn't
either.
CVE-2023-5380, ZDI-CAN-21608
This vulnerability was discovered by:
Sri working with Trend Micro Zero Day Initiative
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Adam Jackson <ajax@redhat.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| Makefile.am | ||
| meson.build | ||
| mi.h | ||
| miarc.c | ||
| mibitblt.c | ||
| micmap.c | ||
| micmap.h | ||
| micoord.h | ||
| micopy.c | ||
| midash.c | ||
| midispcur.c | ||
| mieq.c | ||
| miexpose.c | ||
| mifillarc.c | ||
| mifillarc.h | ||
| mifillrct.c | ||
| mifpoly.h | ||
| migc.c | ||
| migc.h | ||
| miglblt.c | ||
| miinitext.c | ||
| miinitext.h | ||
| miline.h | ||
| mioverlay.c | ||
| mioverlay.h | ||
| mipointer.c | ||
| mipointer.h | ||
| mipointrst.h | ||
| mipoly.c | ||
| mipoly.h | ||
| mipolypnt.c | ||
| mipolyrect.c | ||
| mipolyseg.c | ||
| mipolytext.c | ||
| mipushpxl.c | ||
| miscanfill.h | ||
| miscrinit.c | ||
| misprite.c | ||
| misprite.h | ||
| mistruct.h | ||
| mivalidate.h | ||
| mivaltree.c | ||
| miwideline.c | ||
| miwideline.h | ||
| miwindow.c | ||
| mizerarc.c | ||
| mizerarc.h | ||
| mizerclip.c | ||
| mizerline.c | ||