Bug 1168716 (CVE-2014-8103)

Summary: CVE-2014-8103 xorg-x11-server: out of bounds access due to not validating length or offset values in DRI3 & Present extensions
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: airlied, ajax, chazlett, jrusnack, peter.hutterer, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-11 20:58:36 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1170916, 1170917, 1170918, 1170919    
Bug Blocks: 1168310    
Attachments:
Description Flags
0011-dri3_unvalidated_lengths_in_DRI3_extension_swapped_procs_CVE-2014-8103_1-2.patch
none
0012-present_unvalidated_lengths_in_Present_extension_procs_CVE-2014-8103_2-2.patch none

Description Vasyl Kaigorodov 2014-11-27 16:09:44 UTC 
Various functions calls in DRI3 & Present extensions
do not check that the lengths and/or indexes sent by the
client are within the bounds specified by the caller or the bounds of
the memory allocated to hold the request read from the client, so could
read or write past the bounds of allocated memory while processing the
request. These calls all occur only after a client has successfully
authenticated itself.

Affected functions: sproc_dri3_query_version(), sproc_dri3_open(),
 sproc_dri3_pixmap_from_buffer(), sproc_dri3_buffer_from_pixmap(),
 sproc_dri3_fence_from_fd(), sproc_dri3_fd_from_fence(),
 proc_present_query_capabilities(), sproc_present_query_version(),
 sproc_present_pixmap(), sproc_present_notify_msc(),
 sproc_present_select_input(), sproc_present_query_capabilities()

Introduced in xorg-server-1.15.0 (2013).
Comment 1 Vasyl Kaigorodov 2014-11-27 16:09:59 UTC 
Created attachment 962154 [details]
0011-dri3_unvalidated_lengths_in_DRI3_extension_swapped_procs_CVE-2014-8103_1-2.patch
Comment 2 Vasyl Kaigorodov 2014-11-27 16:10:01 UTC 
Created attachment 962155 [details]
0012-present_unvalidated_lengths_in_Present_extension_procs_CVE-2014-8103_2-2.patch
Comment 3 Huzaifa S. Sidhpurwala 2014-12-05 06:10:56 UTC 
OOB read leading to crash.
Comment 5 Vincent Danen 2014-12-09 20:17:42 UTC 
External References:

http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/
Comment 6 errata-xmlrpc 2014-12-11 19:42:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7
  Red Hat Enterprise Linux 6

Via RHSA-2014:1983 https://rhn.redhat.com/errata/RHSA-2014-1983.html