Bug 582601 (CVE-2010-1166)

Summary:	CVE-2010-1166 Xorg: X server Render extension memory corruption
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	VERIFIED ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	ajax
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	495733, 582651
Bug Blocks:

Description Tomas Hoger 2010-04-15 12:04:32 UTC

A memory corruption flaw was discovered in Xorg X server's Render extension.  Problem originally reported as Firefox crashing X server issue was tracked down to an incorrect calculation issue in mod() macro by Olivier Fourdan:

  https://bugzilla.redhat.com/show_bug.cgi?id=495733#c15

This issue could cause mod() to return value greater than its second argument (the divisor), resulting in excessive read and write in Render composite operation, causing heap or video memory corruption.

Comment 1 Tomas Hoger 2010-04-15 12:11:52 UTC

mod() macro has the same definition in Xorg and XFree86 in Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 3 respectively, but in those versions, no expression is used as the first operand (the dividend).

The expression causing incorrect calculation was added upstream via:
  http://cgit.freedesktop.org/xorg/xserver/commit/?id=7c84189ea1
  https://bugs.freedesktop.org/show_bug.cgi?id=3566

Comment 2 Tomas Hoger 2010-04-15 12:33:38 UTC

In current X server versions, there is similar issue in fbWalkCompositeRegion.  However, it does not seem to be called in the current code.  It was previous called from fbComposite:

  http://cgit.freedesktop.org/xorg/xserver/commit/?id=d2f813f7db

but it does not call it any more.

Comment 5 Josh Bressers 2010-04-28 11:33:38 UTC

Removing embargo

Comment 6 errata-xmlrpc 2010-04-28 12:06:37 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0382 https://rhn.redhat.com/errata/RHSA-2010-0382.html