Bug 413811 (CVE-2007-6427) - CVE-2007-6427 xorg / xfree86: memory corruption via XInput extension
Summary: CVE-2007-6427 xorg / xfree86: memory corruption via XInput extension
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-6427
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 419451 419461 419481 419501 419521 419531 429125 429126 429127
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-12-06 11:45 UTC by Tomas Hoger
Modified: 2019-09-29 12:22 UTC (History)
6 users (show)

Fixed In Version: 1.3.0.0-39.fc8
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-01-22 15:31:51 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0029 0 normal SHIPPED_LIVE Important: XFree86 security update 2008-01-19 02:59:54 UTC
Red Hat Product Errata RHSA-2008:0030 0 normal SHIPPED_LIVE Important: xorg-x11 security update 2008-01-19 02:20:50 UTC
Red Hat Product Errata RHSA-2008:0031 0 normal SHIPPED_LIVE Important: xorg-x11-server security update 2008-01-19 01:28:40 UTC

Description Tomas Hoger 2007-12-06 11:45:28 UTC
iDefense reported a vulnerability discovered by regenrecht affecting Xorg X server:

DESCRIPTION

Local exploitation of a memory corruption vulnerability in the X.Org X
server, as included in various vendors' operating system distributions,
could allow an attacker to execute arbitrary code with the privileges of
the X server, typically root.

The vulnerable code exists within multiple functions in the XInput
extension, and occurs when swapping the byte order of client requests.
By claiming to be sending integer data in the opposite byte order of
the server, the client can cause the server to swap the byte order of a
request. The number of bytes swapped can be controlled by the client,
and is not properly validated by the server. This results in the
corruption of heap memory located after the client's request data.

The vulnerable code is shown below:

From Xi/chgkmap.c:SProcXChangeDeviceKeyMapping()

87  REQUEST_AT_LEAST_SIZE(xChangeDeviceKeyMappingReq);

88  p = (long *)&stuff[1];

89  count = stuff->keyCodes * stuff->keySymsPerKeyCode;

90  for (i = 0; i < count; i++) {

91   swapl(p, n);

92   p++;

93  }

On line 89, the count value is calculated by multiplying two values
taken directly from the client request. The for loop then proceeds to
swap the byte order of the request data, and eventually of other heap
memory as well.

Duplicate vulnerabilities are also found in the following functions:

Xi/chgprop.c, SProcXChangeDeviceDontPropagateList()

Xi/grabdev.c, SProcXGrabDevice()

Xi/grabdevb.c, SProcXGrabDeviceButton()

Xi/grabdevk.c, SProcXGrabDeviceKey()

Xi/selectev.c, SProcXSelectExtensionEvent()

Xi/sendexev.c, SProcXSendExtensionEvent()

ANALYSIS

Exploitation allows an attacker to execute arbitrary code with root
privileges. In order to exploit this vulnerability, an attacker must be
able to send commands to an affected X server. This typically requires
access to the console or access to the same account as a user who is on
the console. One method of gaining the required access is to remotely
exploit a vulnerability in, for example, a graphical web browser. This
would then allow an attacker to exploit this vulnerability and elevate
their privileges to root.

If an X Server is configured to listen for TCP based client connections,
and a client is granted access to create sessions (via the xhosts file),
then the vulnerability can be exploited remotely.

WORKAROUND

iDefense is currently unaware of any workarounds for this issue. The
XInput extension is normally compiled into the X Server; as such, it's
not possible to disable it from being loaded in the configuration file.

Comment 1 Tomas Hoger 2007-12-06 11:47:17 UTC
Upstream bug report:

  https://bugs.freedesktop.org/show_bug.cgi?id=13522

Comment 11 Yan Tian 2008-01-15 09:20:33 UTC
Verified patch 'freedesktop-bug-13522.patch' was excluded from
xorg-x11-6.8.2-1.EL.33.0.1.src.rpm. And the patch 'cve-2007-6427.patch' fixed
chgprop.c, sendexev.c, chgkmap.c, grabdevb.c, selectev.c, grabdevk.c, grabdev.c
and chgfctl.c files.

Comment 15 Josh Bressers 2008-01-17 14:50:09 UTC
Lifting embargo:
http://lists.freedesktop.org/archives/xorg/2008-January/031918.html

Comment 17 Lawrence Lim 2008-01-18 04:42:39 UTC
From https://bugs.freedesktop.org/show_bug.cgi?id=13522#c4

Without the fix, the X server crashes, with it, for all the above it should
print:
        TEST PASSED: illegal call returned BadLength

============
Test Case 2 did not pass with  XFree86-4.3.0-125.EL.src.rpm on PPC arch 
<ppcp-3as.lab.boston.redhat.com>

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 1
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing ChangeDeviceDontPropagateList...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 2
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing ChangeDeviceKeyMapping...
X Error of failed request:  BadDevice, invalid or uninitialized input device
  Major opcode of failed request:  146 (XInputExtension)
  Minor opcode of failed request:  25 (X_ChangeDeviceKeyMapping)
  Serial number of failed request:  11
  Current serial number in output stream:  12

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 3
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing GrabDevice...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 4
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing GrabDeviceButton...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 5
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing GrabDeviceKey...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 6
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing SelectExtensionEvent...
TEST PASSED: illegal call returned BadLength

[root@spike ~]# DISPLAY=`ppcp-3as.lab.boston.redhat.com`:0.0 ./testcase-13522 7
bash: ppcp-3as.lab.boston.redhat.com: command not found
Testing SendExtensionEvent...
TEST PASSED: illegal call returned BadLength


Comment 18 Fedora Update System 2008-01-22 15:31:41 UTC
xorg-x11-server-1.3.0.0-39.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 19 Fedora Update System 2008-01-22 15:49:12 UTC
xorg-x11-server-1.3.0.0-15.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.