Bug 1168713 (CVE-2014-8101)

Summary: CVE-2014-8101 xorg-x11-server: out of bounds access due to not validating length or offset values in RandR extension
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: airlied, ajax, chazlett, jrusnack, peter.hutterer, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server.
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-11 20:58:16 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1170916, 1170917, 1170918, 1170919, 1170932    
Bug Blocks: 1168310    
Attachments:
Description Flags
0013-randr_unvalidated_lengths_in_RandR_extension_swapped_procs_CVE-2014-8101.patch none

Description Vasyl Kaigorodov 2014-11-27 16:05:48 UTC
Various RandR extension calls do not check that the lengths and/or indexes sent by the
client are within the bounds specified by the caller or the bounds of
the memory allocated to hold the request read from the client, so could
read or write past the bounds of allocated memory while processing the
request. These calls all occur only after a client has successfully
authenticated itself.

Comment 1 Vasyl Kaigorodov 2014-11-27 16:06:04 UTC
Created attachment 962152 [details]
0013-randr_unvalidated_lengths_in_RandR_extension_swapped_procs_CVE-2014-8101.patch

Comment 2 Huzaifa S. Sidhpurwala 2014-12-05 06:07:12 UTC
OOb read via client request causing X server crash.

Comment 5 Vincent Danen 2014-12-09 20:17:43 UTC
External References:

http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/

Comment 6 errata-xmlrpc 2014-12-11 17:35:21 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1982 https://rhn.redhat.com/errata/RHSA-2014-1982.html

Comment 7 errata-xmlrpc 2014-12-11 19:42:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2014:1983 https://rhn.redhat.com/errata/RHSA-2014-1983.html