====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN440
_____________________________________________________________________

DATE                : 12/08/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running libX11 versions prior to 1.6.10,
                          xorg-server versions prior to 1.20.9.

=====================================================================
https://lists.x.org/archives/xorg-announce/2020-July/003050.html
https://lists.x.org/archives/xorg-announce/2020-July/003051.html
_____________________________________________________________________

X.Org security advisory: July 31, 2020

Heap corruption in the X input method client in libX11
======================================================

CVE-2020-14344

The X Input Method (XIM) client implementation in libX11 has some
integer overflows and signed/unsigned comparison issues that can lead
to heap corruption when handling malformed messages from an input
method.

Patches
=======

Patches for these issues have been commited to the libX11 git repository.
libX11 1.6.10 will be released shortly and will include those patches.

https://gitlab.freedesktop.org/xorg/lib/libx11

commit 1703b9f3435079d3c6021e1ee2ec34fd4978103d (HEAD -> master)

    Change the data_len parameter of _XimAttributeToValue() to CARD16

    It's coming from a length in the protocol (unsigned) and passed
    to functions that expect unsigned int parameters (_XCopyToArg()
    and memcpy()).

commit 1a566c9e00e5f35c1f9e7f3d741a02e5170852b2

    Zero out buffers in functions

    It looks like uninitialized stack or heap memory can leak
    out via padding bytes.


commit 2fcfcc49f3b1be854bb9085993a01d17c62acf60

    Fix more unchecked lengths

commit 388b303c62aa35a245f1704211a023440ad2c488

    fix integer overflows in _XimAttributeToValue()


commit 0e6561efcfaa0ae7b5c74eac7e064b76d687544e

    Fix signed length values in _XimGetAttributeID()

    The lengths are unsigned according to the specification. Passing
    negative values can lead to data corruption.

Thanks
======

X.Org thanks Todd Carson for reporting these issues to our security
team and assisting them in understanding them and providing fixes.



Matthieu Herrb

_____________________________________________________________________

X.Org security advisory: July 31, 2020

X Server Pixel Data Uninitialized Memory Information Disclosure
===============================================================

CVE-2020-14347

Allocation for pixmap data in AllocatePixmap() does not initialize the
memory in xserver, it leads to leak uninitialize heap memory to
clients. When the X server runs with elevated privileges.

This flaw can lead to ASLR bypass, which when combined with other
flaws (known/unknown) could lead to lead to privilege elevation in the
client.

Patch
=====

A patch for this issue has been commited to the xorg server git
repository.  xorg-server 1.20.9 will be released shortly and will
include this patch.

https://gitlab.freedesktop.org/xorg/xserver.git

diff --git a/dix/pixmap.c b/dix/pixmap.c
index 1186d7dbb..5a0146bbb 100644
--- a/dix/pixmap.c
+++ b/dix/pixmap.c
@@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
     if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize)
         return NullPixmap;

-    pPixmap = malloc(pScreen->totalPixmapSize + pixDataSize);
+    pPixmap = calloc(1, pScreen->totalPixmapSize + pixDataSize);
     if (!pPixmap)
         return NullPixmap;

Thanks
======

This vulnerability was discovered by Jan-Niklas Sohn working with
Trend Micro Zero Day Initiative.

-- 
Matthieu Herrb

=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================