Bug 1212102 (CVE-2023-3138)

Created attachment 867442 [details]
0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch

0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch

Created attachment 867443 [details]
0001-XRRQueryVersion-add-test-for-XQueryExtension-overflo.patch

0001-XRRQueryVersion-add-test-for-XQueryExtension-overflo.patch

comment for above 2 patches:

On 6/1/23 06:44, Adam Jackson wrote:
> The app can call XESetEventToWire by hand at any point, so that probably does 
> want to sanitize event_number before updating the array. XESetCopyEventCookie 
> just masks the extension number with 0x7F, that'd be a fine approach.

While that works, it's a side effect of mapping the extension opcode from the
128-255 space down to 0-127 so that the array doesn't have to have 128 unused
entries for the core protocol request opcodes.

I chose to add actual checks and just drop invalid values as either your
server is malicious/buggy or your connection is corrupting data - with a
warning printed to stderr when it happens.  (It's unfortunate that Xlib
never developed a better mechanism for warnings or errors than printing
to stderr, as the error handler mechanism only handles errors passed over
the protocol itself, not issues detected locally - but that's what we have
to work with here.)

I also hacked up a quick test case (provided as a patch against
https://gitlab.freedesktop.org/xorg/test/xhiv which is attached),
and it seems to detect overflow before the fix and not after.

Thoughts?

        -alan-

original report:

From: Gregory James DUCK <gjduck@gmail.com>
Date: Wed, 31 May 2023 13:09:53 +0800
Subject: Possible sub-object overflow in XESetEventToWire

Hi,

There is a possible sub-object overflow in the Xlib library (libx11-1.8.4):

   1. The XQueryExtension() function, as far as I can tell, does not
   validate the first_event member of the reply:

   typedef struct {
       ...
       *CARD8 first_event;*
       ...
       } xQueryExtensionReply;

   Since type type is CARD8, the unchecked value can be within the range
   0..255.
   2. The unchecked value can be passed to XESetEventToWire() (e.g., via
   XFixesExtAddDisplay() from libxfixes), which is used to update the
   wire_vec[] array in the Display structure:

   EventToWireType XESetEventToWire(...)
   {
       ...
       *dpy->wire_vec[event_number] = proc;*
       ...
   }

   However, wire_vec is an array of only 128 elements, so an unchecked
   first_event (now event_number) can exceed this bound, leading to a
   sub-object bounds overflow (overwrite).
   3. This can be used to overwrite other function pointers in the Display
   struct, such as idlist_alloc and savedsynchandler. This could be used
   for code-reuse attacks assuming that messages are intercepted or an
   untrusted server.

At the very least I can get the client to crash.  Whether or not it is more
serious is not clear, but code reuse might have potential.

Reproducing the problem is a bit tricky.  One way is to manually edit the
packet in _XReply() using gdb.  A value of first_event=138 can produce a
crash for me if called from XFixesExtAddDisplay().  The test program I was
using is xcalc.

Cheers, -Greg.

Created attachment 867510 [details]
0001-InitExt.c-Add-bounds-checks-for-extension-request-ev.patch

Submitted fixes for

- SLE-15_Update
- SLE-12_Update
- SLE-11_Update

Will checkin X11:XOrg/libX11 and submit for factory/TW after CRD. Reassigning to security team.

Security and fix released today.

https://www.spinics.net/lists/xorg/msg60929.html

(In reply to Stefan Dirsch from comment #7)

> Will checkin X11:XOrg/libX11 and submit for factory/TW after CRD.
> Reassigning to security team.

done.

This is an autogenerated message for OBS integration:
This bug (1212102) was mentioned in
https://build.opensuse.org/request/show/1093353 Factory / libX11

public

SUSE-SU-2023:2531-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1212102
CVE References: CVE-2023-3138
Sources used:
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): libX11-1.6.2-12.30.1
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): libX11-1.6.2-12.30.1
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): libX11-1.6.2-12.30.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): libX11-1.6.2-12.30.1
SUSE Linux Enterprise Server 12 SP5 (src): libX11-1.6.2-12.30.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): libX11-1.6.2-12.30.1
SUSE OpenStack Cloud 9 (src): libX11-1.6.2-12.30.1
SUSE OpenStack Cloud Crowbar 9 (src): libX11-1.6.2-12.30.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): libX11-1.6.2-12.30.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): libX11-1.6.2-12.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

SUSE-SU-2023:2614-1: An update that solves one vulnerability can now be installed.

Category: security (important)
Bug References: 1212102
CVE References: CVE-2023-3138
Sources used:
openSUSE Leap Micro 5.3 (src): libX11-1.6.5-150000.3.30.1
openSUSE Leap 15.4 (src): libX11-1.6.5-150000.3.30.1
openSUSE Leap 15.5 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Micro 5.3 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Micro 5.4 (src): libX11-1.6.5-150000.3.30.1
Basesystem Module 15-SP4 (src): libX11-1.6.5-150000.3.30.1
Basesystem Module 15-SP5 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Real Time 15 SP3 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): libX11-1.6.5-150000.3.30.1
SUSE Manager Proxy 4.2 (src): libX11-1.6.5-150000.3.30.1
SUSE Manager Retail Branch Server 4.2 (src): libX11-1.6.5-150000.3.30.1
SUSE Manager Server 4.2 (src): libX11-1.6.5-150000.3.30.1
SUSE Enterprise Storage 7.1 (src): libX11-1.6.5-150000.3.30.1
SUSE Enterprise Storage 7 (src): libX11-1.6.5-150000.3.30.1
SUSE CaaS Platform 4.0 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Micro 5.2 (src): libX11-1.6.5-150000.3.30.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): libX11-1.6.5-150000.3.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

done, closing