ecc634f1b2
CreateSaverWindow stores pPriv (the ScreenSaverScreenPrivatePtr) in a local variable via the SetupScreen macro at function entry. When an existing saver window is being replaced, the function sets pPriv->hasWindow = FALSE and calls CheckScreenPrivate(). If at this point pPriv->attr is NULL (cleared by a prior UnsetAttributes call), pPriv->events is NULL, and pPriv->installedMap is None, then CheckScreenPrivate determines the screen private is unused, frees it, and sets the screen private pointer to NULL. The function then continues to dereference the now-freed pPriv on the very next line (pPriv->attr), resulting in a use-after-free. On glibc 2.34+, the tcache key at offset 8 within the freed block makes pPriv->attr appear non-NULL, causing the function to continue operating on garbage data and eventually crash. The attack sequence is: 1. SetAttributes (creates pPriv with pPriv->attr set) 2. ForceScreenSaver(Active) (creates saver window, pPriv->hasWindow=TRUE) 3. UnsetAttributes (sets pPriv->attr = NULL) 4. ForceScreenSaver(Active) (re-enters CreateSaverWindow → UAF) Fix by re-fetching pPriv from the screen private after CheckScreenPrivate returns, so the subsequent NULL check correctly detects the freed state. ScreenSaverFreeAttr has the same pattern, force pPriv to NULL there too even though it has no real effect. This vulnerability was discovered by: Anonymous working with TrendAI Zero Day Initiative ZDI-CAN-30168 Assisted-by: Claude:claude-opus-4-6 Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2228> |
||
|---|---|---|
| .gitlab-ci | ||
| composite | ||
| config | ||
| damageext | ||
| dbe | ||
| dix | ||
| doc | ||
| dri3 | ||
| exa | ||
| fb | ||
| glamor | ||
| glx | ||
| hw | ||
| include | ||
| man | ||
| mi | ||
| miext | ||
| os | ||
| present | ||
| pseudoramiX | ||
| randr | ||
| record | ||
| render | ||
| test | ||
| Xext | ||
| xfixes | ||
| Xi | ||
| xkb | ||
| .appveyor.yml | ||
| .dir-locals.el | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| .mailmap | ||
| .travis.yml | ||
| COPYING | ||
| meson.build | ||
| meson_options.txt | ||
| README.md | ||
| SECURITY.md | ||
| xorg-server.m4 | ||
| xorg-server.pc.in | ||
| xserver.ent.in | ||
X Server
The X server accepts requests from client applications to create windows, which are (normally rectangular) "virtual screens" that the client program can draw into.
Windows are then composed on the actual screen by the X server (or by a separate composite manager) as directed by the window manager, which usually communicates with the user via graphical controls such as buttons and draggable titlebars and borders.
For a comprehensive overview of X Server and X Window System, consult the following article: https://en.wikipedia.org/wiki/X_server
All questions regarding this software should be directed at the Xorg mailing list:
https://lists.freedesktop.org/mailman/listinfo/xorg
The primary development code repository can be found at:
https://gitlab.freedesktop.org/xorg/xserver
For patch submission instructions, see:
https://www.x.org/wiki/Development/Documentation/SubmittingPatches
As with other projects hosted on freedesktop.org, X.Org follows its Code of Conduct, based on the Contributor Covenant. Please conduct yourself in a respectful and civilized manner when using the above mailing lists, bug trackers, etc: