Bug 950290 (CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601) – <x11-base/xorg-server-21.1.16, <x11-base/xwayland-24.1.6 multiple vulnerabilities

• Product: Gentoo Security
• Status: IN_PROGRESS ---

[Description Chí-Thanh Christopher Nguyễn 2025-02-25 20:30:56 UTC]

======================================================================
X.Org Security Advisory: February 25, 2025

Issues in X.Org X server prior to 21.1.16 and Xwayland prior to 24.1.6
======================================================================

Multiple issues have been found in the X server and Xwayland implementations
published by X.Org for which we are releasing security fixes for in
xorg-server-21.1.16 and xwayland-24.1.6.

1) CVE-2025-26594: Use-after-free of the root cursor

Introduced in: Unknown - Prior to X11R6.6 Xorg baseline
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The root cursor is referenced in the xserver as a global variable. If
a client manages to free the root cursor, the internal reference points
to freed memory and causes a use-after-free.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

2) CVE-2025-26595: Buffer overflow in XkbVModMaskText()

Introduced in: Prior to X11R6.1
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The code in XkbVModMaskText() allocates a fixed sized buffer on the
stack and copies the names of the virtual modifiers to that buffer.

The code however fails to check the bounds of the buffer correctly and
would copy the data regardless of the size, which may lead to a buffer
overflow.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

3) CVE-2025-26596: Heap overflow in XkbWriteKeySyms()

Introduced in: initial version of xc/programs/Xserver/xkb/xkb.c in X11R6
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The computation of the length in XkbSizeKeySyms() differs from what is
actually written in XkbWriteKeySyms(), which may lead to a heap based
buffer overflow.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

4) CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey()

Introduced in: X11R6.1
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

If XkbChangeTypesOfKey() is called with 0 group, it will resize the key
symbols table to 0 but leave the key actions unchanged.
    
If later, the same function is called with a non-zero value of groups,
this will cause a buffer overflow because the key actions are of the wrong
size.

5) CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()

Introduced in: xorg-server-1.14.0
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The function GetBarrierDevice() searches for the pointer device based on
its device id and returns the matching value, or supposedly NULL if no
match was found.
    
However the code will return the last element of the list if no matching
device id was found which can lead to out of bounds memory access.

6) CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()

Introduced in: Xorg 6.8.0.
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The function compCheckRedirect() may fail if it cannot allocate the backing
pixmap. In that case, compRedirectWindow() will return a BadAlloc error
without the validation of the window tree marked just before, which leaves
the validate data partly initialized, and the use of an uninitialized pointer
later.

7) CVE-2025-26600: Use-after-free in PlayReleasedEvents()

Introduced in: X11R5
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed and replaying the events
will cause a use after free.

8) CVE-2025-26601: Use-after-free in SyncInitTrigger()

Introduced in: X11R6
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

When changing an alarm, the values of the change mask are evaluated one
after the other, changing the trigger values as requested and eventually,
SyncInitTrigger() is called.
If one of the changes triggers an error, the function will return early,
not adding the new sync object.
This can be used to cause a use after free when the alarm eventually
triggers.

[Comment 1 Larry the Git Cow 2025-02-25 20:37:29 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eb8e7bf0f11b5940bc469c25fec3eb02e2397e13

commit eb8e7bf0f11b5940bc469c25fec3eb02e2397e13
Author:     Matt Turner <[e-mail]>
AuthorDate: 2025-02-25 20:35:50 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2025-02-25 20:37:08 +0000

    x11-base/xwayland: Version bump to 24.1.6
    
    Bug: https://bugs.gentoo.org/950290
    Signed-off-by: Matt Turner <[e-mail]>

 x11-base/xwayland/Manifest               |   1 +
 x11-base/xwayland/xwayland-24.1.6.ebuild | 133 +++++++++++++++++++++++++++++++
 2 files changed, 134 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=5589e3ed1d3fe48365ea3ba361b448dbfcc9579a

commit 5589e3ed1d3fe48365ea3ba361b448dbfcc9579a
Author:     Matt Turner <[e-mail]>
AuthorDate: 2025-02-25 20:34:51 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2025-02-25 20:37:02 +0000

    x11-base/xorg-server: Version bump to 21.1.16
    
    Bug: https://bugs.gentoo.org/950290
    Signed-off-by: Matt Turner <[e-mail]>

 x11-base/xorg-server/Manifest                   |   1 +
 x11-base/xorg-server/xorg-server-21.1.16.ebuild | 194 ++++++++++++++++++++++++
 2 files changed, 195 insertions(+)

[Comment 2 Larry the Git Cow 2025-04-03 00:02:40 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=93ab7e62714ad3a23c3e809768355a51a4b7e7b7

commit 93ab7e62714ad3a23c3e809768355a51a4b7e7b7
Author:     Matt Turner <[e-mail]>
AuthorDate: 2025-04-02 23:58:43 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2025-04-03 00:01:59 +0000

    x11-base/xwayland: Drop old versions
    
    Bug: https://bugs.gentoo.org/950290
    Signed-off-by: Matt Turner <[e-mail]>

 x11-base/xwayland/Manifest               |   1 -
 x11-base/xwayland/xwayland-24.1.5.ebuild | 133 -------------------------------
 2 files changed, 134 deletions(-)

[Comment 3 Larry the Git Cow 2025-04-24 22:32:46 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=24a6f1ccb89ea80c305e3ff907ebfda374cf3d71

commit 24a6f1ccb89ea80c305e3ff907ebfda374cf3d71
Author:     Matt Turner <[e-mail]>
AuthorDate: 2025-04-24 22:31:00 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2025-04-24 22:31:19 +0000

    x11-base/xwayland: Drop old versions
    
    Bug: https://bugs.gentoo.org/950290
    Signed-off-by: Matt Turner <[e-mail]>

 x11-base/xwayland/Manifest               |   1 -
 x11-base/xwayland/xwayland-24.1.4.ebuild | 133 -------------------------------
 2 files changed, 134 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c518ec89f520186e16cbe7b21b0739c46edd40ef

commit c518ec89f520186e16cbe7b21b0739c46edd40ef
Author:     Matt Turner <[e-mail]>
AuthorDate: 2025-04-24 22:29:52 +0000
Commit:     Matt Turner <[e-mail]>
CommitDate: 2025-04-24 22:31:14 +0000

    x11-base/xorg-server: Drop old versions
    
    Bug: https://bugs.gentoo.org/950290
    Signed-off-by: Matt Turner <[e-mail]>

 x11-base/xorg-server/Manifest                   |   2 -
 x11-base/xorg-server/xorg-server-21.1.14.ebuild | 194 ------------------------
 x11-base/xorg-server/xorg-server-21.1.15.ebuild | 194 ------------------------
 3 files changed, 390 deletions(-)