Bug 582601 (CVE-2010-1166) - CVE-2010-1166 Xorg: X server Render extension memory corruption
Summary: CVE-2010-1166 Xorg: X server Render extension memory corruption
Keywords:
Status: VERIFIED
Alias: CVE-2010-1166
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: source=researcher,reported=20100318,p...
Depends On: 495733 582651
Blocks:
TreeView+ depends on / blocked
 
Reported: 2010-04-15 12:04 UTC by Tomas Hoger
Modified: 2019-06-08 12:59 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0382 normal SHIPPED_LIVE Important: xorg-x11-server security update 2010-04-28 12:06:34 UTC

Description Tomas Hoger 2010-04-15 12:04:32 UTC
A memory corruption flaw was discovered in Xorg X server's Render extension.  Problem originally reported as Firefox crashing X server issue was tracked down to an incorrect calculation issue in mod() macro by Olivier Fourdan:

  https://bugzilla.redhat.com/show_bug.cgi?id=495733#c15

This issue could cause mod() to return value greater than its second argument (the divisor), resulting in excessive read and write in Render composite operation, causing heap or video memory corruption.

Comment 1 Tomas Hoger 2010-04-15 12:11:52 UTC
mod() macro has the same definition in Xorg and XFree86 in Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 3 respectively, but in those versions, no expression is used as the first operand (the dividend).

The expression causing incorrect calculation was added upstream via:
  http://cgit.freedesktop.org/xorg/xserver/commit/?id=7c84189ea1
  https://bugs.freedesktop.org/show_bug.cgi?id=3566

Comment 2 Tomas Hoger 2010-04-15 12:33:38 UTC
In current X server versions, there is similar issue in fbWalkCompositeRegion.  However, it does not seem to be called in the current code.  It was previous called from fbComposite:

  http://cgit.freedesktop.org/xorg/xserver/commit/?id=d2f813f7db

but it does not call it any more.

Comment 5 Josh Bressers 2010-04-28 11:33:38 UTC
Removing embargo

Comment 6 errata-xmlrpc 2010-04-28 12:06:37 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0382 https://rhn.redhat.com/errata/RHSA-2010-0382.html


Note You need to log in before you can comment on or make changes to this bug.