Bug 1168714 (CVE-2014-8102)

Summary: CVE-2014-8102 xorg-x11-server: out of bounds access due to not validating length or offset values in XFixes extension
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: airlied, ajax, chazlett, jrusnack, peter.hutterer, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server.
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-11 20:58:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1170916, 1170917, 1170918, 1170919, 1170932    
Bug Blocks: 1168310    
Description Flags
0016-xfixes_unvalidated_length_in_SProcXFixesSelectSelectionInput_CVE-2014-8102.patch none

Description Vasyl Kaigorodov 2014-11-27 16:07:24 UTC
SProcXFixesSelectSelectionInput() function call in XFixes extension
do not check that the lengths and/or indexes sent by the
client are within the bounds specified by the caller or the bounds of
the memory allocated to hold the request read from the client, so could
read or write past the bounds of allocated memory while processing the
request. These calls all occur only after a client has successfully
authenticated itself.

Comment 1 Vasyl Kaigorodov 2014-11-27 16:07:39 UTC
Created attachment 962153 [details]

Comment 2 Huzaifa S. Sidhpurwala 2014-12-05 06:08:52 UTC
OOB read leading to X server crash.

Comment 5 Vincent Danen 2014-12-09 20:17:46 UTC
External References:


Comment 6 errata-xmlrpc 2014-12-11 17:35:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2014:1982 https://rhn.redhat.com/errata/RHSA-2014-1982.html

Comment 7 errata-xmlrpc 2014-12-11 19:42:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2014:1983 https://rhn.redhat.com/errata/RHSA-2014-1983.html