Bug 413811 - (CVE-2007-6427) CVE-2007-6427 xorg / xfree86: memory corruption via XInput extension
CVE-2007-6427 xorg / xfree86: memory corruption via XInput extension
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
source=vendorsec,reported=20071204,pu...
: Security
Depends On: 419451 419461 419481 419501 419521 419531 429125 429126 429127
Blocks:
  Show dependency treegraph
 
Reported: 2007-12-06 06:45 EST by Tomas Hoger
Modified: 2008-01-31 18:27 EST (History)
7 users (show)

See Also:
Fixed In Version: 1.3.0.0-39.fc8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-01-22 10:31:51 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2007-12-06 06:45:28 EST
iDefense reported a vulnerability discovered by regenrecht affecting Xorg X server:

DESCRIPTION

Local exploitation of a memory corruption vulnerability in the X.Org X
server, as included in various vendors' operating system distributions,
could allow an attacker to execute arbitrary code with the privileges of
the X server, typically root.

The vulnerable code exists within multiple functions in the XInput
extension, and occurs when swapping the byte order of client requests.
By claiming to be sending integer data in the opposite byte order of
the server, the client can cause the server to swap the byte order of a
request. The number of bytes swapped can be controlled by the client,
and is not properly validated by the server. This results in the
corruption of heap memory located after the client's request data.

The vulnerable code is shown below:

From Xi/chgkmap.c:SProcXChangeDeviceKeyMapping()

87  REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

88  p = (long *)&stuff[1];

89  count = stuff->keyCodes * stuff->keySymsPerKeyCode;

90  for (i = 0; i < count; i++) {

91   swapl(p, n);

92   p++;

93  }

On line 89, the count value is calculated by multiplying two values
taken directly from the client request. The for loop then proceeds to
swap the byte order of the request data, and eventually of other heap
memory as well.

Duplicate vulnerabilities are also found in the following functions:

Xi/chgprop.c, SProcXChangeDeviceDontPropagateList()

Xi/grabdev.c, SProcXGrabDevice()

Xi/grabdevb.c, SProcXGrabDeviceButton()

Xi/grabdevk.c, SProcXGrabDeviceKey()

Xi/selectev.c, SProcXSelectExtensionEvent()

Xi/sendexev.c, SProcXSendExtensionEvent()

ANALYSIS

Exploitation allows an attacker to execute arbitrary code with root
privileges. In order to exploit this vulnerability, an attacker must be
able to send commands to an affected X server. This typically requires
access to the console or access to the same account as a user who is on
the console. One method of gaining the required access is to remotely
exploit a vulnerability in, for example, a graphical web browser. This
would then allow an attacker to exploit this vulnerability and elevate
their privileges to root.

If an X Server is configured to listen for TCP based client connections,
and a client is granted access to create sessions (via the xhosts file),
then the vulnerability can be exploited remotely.

WORKAROUND

iDefense is currently unaware of any workarounds for this issue. The
XInput extension is normally compiled into the X Server; as such, it's
not possible to disable it from being loaded in the configuration file.
Comment 1 Tomas Hoger 2007-12-06 06:47:17 EST
Upstream bug report:

  https://bugs.freedesktop.org/show_bug.cgi?id=13522
Comment 11 Yan Tian 2008-01-15 04:20:33 EST
Verified patch 'freedesktop-bug-13522.patch' was excluded from
xorg-x11-6.8.2-1.EL.33.0.1.src.rpm. And the patch 'cve-2007-6427.patch' fixed
chgprop.c, sendexev.c, chgkmap.c, grabdevb.c, selectev.c, grabdevk.c, grabdev.c
and chgfctl.c files.
Comment 15 Josh Bressers 2008-01-17 09:50:09 EST
Lifting embargo:
http://lists.freedesktop.org/archives/xorg/2008-January/031918.html
Comment 17 Lawrence Lim 2008-01-17 23:42:39 EST
From https://bugs.freedesktop.org/show_bug.cgi?id=13522#c4

Without the fix, the X server crashes, with it, for all the above it should
print:
        TEST PASSED: illegal call returned BadLength

============
Test Case 2 did not pass with  XFree86-4.3.0-125.EL.src.rpm on PPC arch 
<ppcp-3as.lab.boston.redhat.com>

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 1
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing ChangeDeviceDontPropagateList...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 2
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing ChangeDeviceKeyMapping...
X Error of failed request:  BadDevice, invalid or uninitialized input device
  Major opcode of failed request:  146 (XInputExtension)
  Minor opcode of failed request:  25 (X_ChangeDeviceKeyMapping)
  Serial number of failed request:  11
  Current serial number in output stream:  12

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 3
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing GrabDevice...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 4
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing GrabDeviceButton...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 5
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing GrabDeviceKey...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 6
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing SelectExtensionEvent...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 7
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing SendExtensionEvent...
TEST PASSED: illegal call returned BadLength
Comment 18 Fedora Update System 2008-01-22 10:31:41 EST
xorg-x11-server-1.3.0.0-39.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 19 Fedora Update System 2008-01-22 10:49:12 EST
xorg-x11-server-1.3.0.0-15.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.