|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: CVE-2022-2319: ZDI-CAN-16062: xorg-x11-server: OOB access in _CheckSetSections() | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Thomas Leroy <thomas.leroy> |
| Component: | Incidents | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Normal | ||
| Priority: | P3 - Medium | CC: | gabriele.sonnu, meissner, sndirsch, thomas.leroy |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| URL: | https://smash.suse.de/issue/319297/ | ||
| Whiteboard: | |||
| Found By: | --- | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Attachments: | 0001-xkb-add-request-length-validation-for-XkbSetGeometry.patch | ||
|
Description
Thomas Leroy
2021-12-30 13:43:24 UTC
Affected codestreams: - SUSE:SLE-11-SP1:Update 7.4-27.40.79.27.1 - SUSE:SLE-11-SP3:Update 7.4-27.122.40.1 - SUSE:SLE-12-SP2:Update 7.6_1.18.3-76.40.1 - SUSE:SLE-12-SP4:Update 1.19.6-4.22.1 - SUSE:SLE-12-SP5:Update 1.19.6-10.23.1 - SUSE:SLE-15:Update 1.19.6 - SUSE:SLE-15-SP1:Update 1.20.3-14.5.16.1 - SUSE:SLE-15-SP2:Update 1.20.3-22.5.36.1 - openSUSE:Leap:15.3:Update 1.20.3 - openSUSE:Factory 21.1.2 Is there already a proposal for a fix available? (In reply to Stefan Dirsch from comment #5) > Is there already a proposal for a fix available? I can't find anything either, we received nothing from upstream and from ZDI. I will let you know once we have further information Thanks for checking. I'll ask again in time for CRD. ;-) SUSE:SLE-15-SP4:Update is also affected Patches are still pending ... Hmm. This is long overdue. Still no patches available ... can you ask again? There is now hurried patch development. We will update the bug further. CVE is CVE-2022-2319 CRD: 2022-07-12 12:00 UTC Created attachment 860031 [details] 0001-xkb-add-request-length-validation-for-XkbSetGeometry.patch From: Peter Hutterer <peter.hutterer@redhat.com> Please see v2 of the patch attached. Note that this patch requires the below MR (in particular the last commit from that MR): https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/933 This version uses the existing _XkbCheckRequestBounds() function for bounds checking, bringing it more in line with the other request handlers. Cheers, Peter I have issues with SUSE:SLE-12-SP2:Update/xorg-x11-server When branching this. I don't have any build repositories defined. So I can't test the build. (In reply to Stefan Dirsch from comment #16) > I have issues with > > SUSE:SLE-12-SP2:Update/xorg-x11-server > > When branching this. I don't have any build repositories defined. So I can't > test the build. Forget about this one. Was my fault. I checked this out years ago it seems. (In reply to Thomas Leroy from comment #4) > Affected codestreams: > - SUSE:SLE-11-SP1:Update 7.4-27.40.79.27.1 rejected because product end-of-life > - SUSE:SLE-11-SP3:Update 7.4-27.122.40.1 > - SUSE:SLE-12-SP2:Update 7.6_1.18.3-76.40.1 > - SUSE:SLE-12-SP4:Update 1.19.6-4.22.1 > - SUSE:SLE-12-SP5:Update 1.19.6-10.23.1 > - SUSE:SLE-15:Update 1.19.6 > - SUSE:SLE-15-SP1:Update 1.20.3-14.5.16.1 > - SUSE:SLE-15-SP2:Update 1.20.3-22.5.36.1 submitted and already checked in. Can be QA'ed. > - openSUSE:Leap:15.3:Update 1.20.3 Need to check this still. Patches should be identical to SUSE:SLE-15-SP2:Update. > - openSUSE:Factory 21.1.2 Prepared. I'll submit this on CRD or the day after. Once I've seen the official announcement. (In reply to Stefan Dirsch from comment #20) > > - openSUSE:Leap:15.3:Update 1.20.3 > > Need to check this still. Patches should be identical to > SUSE:SLE-15-SP2:Update. Sources are identical # iosc rdiff SUSE:SLE-15-SP2:Update xorg-x11-server openSUSE.org:openSUSE:Leap:15.3:Update xorg-x11-server # And sources of openSUSE:Leap:15.3:Update are inherited from SUSE:SLE-15-SP2:Update. # osc branch openSUSE:Leap:15.3:Update xorg-x11-server Note: The branch has been created of a different project, SUSE:SLE-15-SP2:Update, which is the primary location of where development for that package takes place. That's also where you would normally make changes against. A direct branch of the specified package can be forced with the --nodevelproject option. A working copy of the branched package can be checked out with: osc co home:sndirsch:branches:SUSE:SLE-15-SP2:Update/xorg-x11-server ==> So nothing more to do here. Subject: X.Org Security Advisory: July 12, 2022 Date: Tue, 12 Jul 2022 15:55:05 +0300 From: Povilas Kanapickas <povilas@radix.lt> ... X.Org Security Advisory: July 12, 2022 Multiple input validation failures in X server extensions ========================================================= All theses issues can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. * CVE-2022-2319/ZDI-CAN-16062: X.Org Server ProcXkbSetGeometry Out-Of-Bounds Access The handler for the ProcXkbSetGeometry request of the Xkb extension does not properly validate the request length leading to out of bounds memory write. Thanks. Now also checked into devel project (X11:XOrg/xorg-x11-server) and submitted to factory/TW. https://build.opensuse.org/request/show/988635 Reassigning to security team. SUSE-SU-2022:2373-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194179,1194181 CVE References: CVE-2022-2319,CVE-2022-2320 JIRA References: Sources used: SUSE Linux Enterprise Software Development Kit 12-SP5 (src): xorg-x11-server-1.19.6-10.32.1 SUSE Linux Enterprise Server 12-SP5 (src): xorg-x11-server-1.19.6-10.32.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:2370-1: An update that solves two vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1194179,1194181,1200076 CVE References: CVE-2022-2319,CVE-2022-2320 JIRA References: Sources used: openSUSE Leap 15.4 (src): xorg-x11-server-1.20.3-150400.38.5.1 SUSE Linux Enterprise Module for Development Tools 15-SP4 (src): xorg-x11-server-1.20.3-150400.38.5.1 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): xorg-x11-server-1.20.3-150400.38.5.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:2369-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194179,1194181 CVE References: CVE-2022-2319,CVE-2022-2320 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): xorg-x11-server-1.19.6-4.31.1 SUSE OpenStack Cloud 9 (src): xorg-x11-server-1.19.6-4.31.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): xorg-x11-server-1.19.6-4.31.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): xorg-x11-server-1.19.6-4.31.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:2371-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194179,1194181 CVE References: CVE-2022-2319,CVE-2022-2320 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): xorg-x11-server-1.19.6-150000.8.39.1 SUSE Linux Enterprise Server 15-LTSS (src): xorg-x11-server-1.19.6-150000.8.39.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): xorg-x11-server-1.19.6-150000.8.39.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): xorg-x11-server-1.19.6-150000.8.39.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:2372-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194179,1194181 CVE References: CVE-2022-2319,CVE-2022-2320 JIRA References: Sources used: SUSE Linux Enterprise Server 12-SP3-BCL (src): xorg-x11-server-7.6_1.18.3-76.49.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): xorg-x11-server-7.6_1.18.3-76.49.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:2375-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194179,1194181 CVE References: CVE-2022-2319,CVE-2022-2320 JIRA References: Sources used: openSUSE Leap 15.4 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 openSUSE Leap 15.3 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Manager Server 4.1 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Manager Retail Branch Server 4.1 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Manager Proxy 4.1 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise Workstation Extension 15-SP4 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise Workstation Extension 15-SP3 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): xorg-x11-server-1.20.3-150200.22.5.55.1 SUSE Enterprise Storage 7 (src): xorg-x11-server-1.20.3-150200.22.5.55.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. SUSE-SU-2022:2374-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1194179,1194181 CVE References: CVE-2022-2319,CVE-2022-2320 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): xorg-x11-server-1.20.3-150100.14.5.25.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): xorg-x11-server-1.20.3-150100.14.5.25.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): xorg-x11-server-1.20.3-150100.14.5.25.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): xorg-x11-server-1.20.3-150100.14.5.25.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): xorg-x11-server-1.20.3-150100.14.5.25.1 SUSE Enterprise Storage 6 (src): xorg-x11-server-1.20.3-150100.14.5.25.1 SUSE CaaS Platform 4.0 (src): xorg-x11-server-1.20.3-150100.14.5.25.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination. done |