Bug 1168680 (CVE-2014-8091)

Summary: CVE-2014-8091 xorg-x11-server: denial of service due to unchecked malloc in client authentication
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: airlied, ajax, chazlett, jrusnack, peter.hutterer, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
It was found that the X.Org server did not properly handle SUN-DES-1 (Secure RPC) authentication credentials. A malicious, unauthenticated client could use this flaw to crash the X.Org server by submitting a specially crafted authentication request.
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-11 20:56:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1170916, 1170917, 1170918, 1170919, 1170932    
Bug Blocks: 1168310    
Attachments:
Description Flags
0001-unchecked_malloc_may_allow_unauthed_client_to_crash_Xserver_CVE-2014-8091.patch none

Description Vasyl Kaigorodov 2014-11-27 15:08:02 UTC
In servers built with support for SUN-DES-1 (Secure RPC)
authentication credentials, an unauthenticated client may be able to
crash the X server by sending a connection request specifying values
that cause malloc to fail, causing the authentication routines to
attempt to write data to the returned NULL pointer.  Since the request
is limited to an unsigned 16-bit integer for the allocation size, it is 
unlikely to fail unless the server is severely memory constrained.

Introduced in the initial revision of Secure RPC support in X11R5 (1991)

Comment 1 Vasyl Kaigorodov 2014-11-27 15:12:07 UTC
Created attachment 962110 [details]
0001-unchecked_malloc_may_allow_unauthed_client_to_crash_Xserver_CVE-2014-8091.patch

Comment 2 Huzaifa S. Sidhpurwala 2014-12-05 05:19:50 UTC
This issue arises because Xorg server fails to check the return value from a malloc call. The size of data(len) to be malloced is set by the authenticated client. 

len is unsigned 16 bits (as per the X protocol, sent by the client), though the server casts it into a int.

So, successful exploitation will require malloc to fail when allocating a buffer of size UINT16_MAX

Comment 5 Vincent Danen 2014-12-09 20:12:52 UTC
External References:

http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/

Comment 6 errata-xmlrpc 2014-12-11 17:35:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1982 https://rhn.redhat.com/errata/RHSA-2014-1982.html

Comment 7 errata-xmlrpc 2014-12-11 19:42:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2014:1983 https://rhn.redhat.com/errata/RHSA-2014-1983.html