Attachment 870114 Details for Bug 1216133

[patch] 0001-mi-reset-the-PointerWindows-reference-on-screen-swit.patch

0001-mi-reset-the-PointerWindows-reference-on-screen-swit.patch (text/plain), 3.26 KB, created by Marcus Meissner on 2023-10-12 06:58:13 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Marcus Meissner

Created: 2023-10-12 06:58:13 UTC

Size: 3.26 KB

patch

obsolete

>From 344bdc9b8075bc98ddad46439f04f17b8a681cc5 Mon Sep 17 00:00:00 2001
>From: Peter Hutterer <peter.hutterer@who-t.net>
>Date: Thu, 5 Oct 2023 12:19:45 +1000
>Subject: [PATCH xserver] mi: reset the PointerWindows reference on screen
> switch
>
>PointerWindows[] keeps a reference to the last window our sprite
>entered - changes are usually handled by CheckMotion().
>
>If we switch between screens via XWarpPointer our
>dev->spriteInfo->sprite->win is set to the new screen's root window.
>If there's another window at the cursor location CheckMotion() will
>trigger the right enter/leave events later. If there is not, it skips
>that process and we never trigger LeaveWindow() - PointerWindows[] for
>the device still refers to the previous window.
>
>If that window is destroyed we have a dangling reference that will
>eventually cause a use-after-free bug when checking the window hierarchy
>later.
>
>To trigger this, we require:
>- two protocol screens
>- XWarpPointer to the other screen's root window
>- XDestroyWindow before entering any other window
>
>This is a niche bug so we hack around it by making sure we reset the
>PointerWindows[] entry so we cannot have a dangling pointer. This
>doesn't handle Enter/Leave events correctly but the previous code didn't
>either.
>
>CVE-2023-5380, ZDI-CAN-21608
>
>This vulnerability was discovered by:
>Sri working with Trend Micro Zero Day Initiative
>
>Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
>Reviewed-by: Adam Jackson <ajax@redhat.com>
>---
> dix/enterleave.h   |  2 --
> include/eventstr.h |  3 +++
> mi/mipointer.c     | 17 +++++++++++++++--
> 3 files changed, 18 insertions(+), 4 deletions(-)
>
>diff --git dix/enterleave.h dix/enterleave.h
>index 4b833d8a3b..e8af924c68 100644
>--- dix/enterleave.h
>+++ dix/enterleave.h
>@@ -58,8 +58,6 @@ extern void DeviceFocusEvent(DeviceIntPtr dev,
> 
> extern void EnterWindow(DeviceIntPtr dev, WindowPtr win, int mode);
> 
>-extern void LeaveWindow(DeviceIntPtr dev);
>-
> extern void CoreFocusEvent(DeviceIntPtr kbd,
>                            int type, int mode, int detail, WindowPtr pWin);
> 
>diff --git include/eventstr.h include/eventstr.h
>index 93308f9b24..a9926eaeef 100644
>--- include/eventstr.h
>+++ include/eventstr.h
>@@ -335,4 +335,7 @@ union _InternalEvent {
>     GestureEvent gesture_event;
> };
> 
>+extern void
>+LeaveWindow(DeviceIntPtr dev);
>+
> #endif
>diff --git mi/mipointer.c mi/mipointer.c
>index a638f25d4a..8cf0035140 100644
>--- mi/mipointer.c
>+++ mi/mipointer.c
>@@ -397,8 +397,21 @@ miPointerWarpCursor(DeviceIntPtr pDev, ScreenPtr pScreen, int x, int y)
> #ifdef PANORAMIX
>         && noPanoramiXExtension
> #endif
>-        )
>-        UpdateSpriteForScreen(pDev, pScreen);
>+        ) {
>+            DeviceIntPtr master = GetMaster(pDev, MASTER_POINTER);
>+            /* Hack for CVE-2023-5380: if we're moving
>+             * screens PointerWindows[] keeps referring to the
>+             * old window. If that gets destroyed we have a UAF
>+             * bug later. Only happens when jumping from a window
>+             * to the root window on the other screen.
>+             * Enter/Leave events are incorrect for that case but
>+             * too niche to fix.
>+             */
>+            LeaveWindow(pDev);
>+            if (master)
>+                LeaveWindow(master);
>+            UpdateSpriteForScreen(pDev, pScreen);
>+    }
> }
> 
> /**
>-- 
>2.41.0
>

Actions: View | Diff

Attachments on bug 1216133: 870114