Kees Cook from oss-security mailing list:
Adding an input device with a malicious name can trigger a format
string flaw in Xorg's logging subsystem. For builds of Xorg lacking
-D_FORTIFY_SOURCE=2 (or 32-bit systems lacking the fix to fortify)
this can lead to arbitrary code execution as the Xorg user, usually
root. When built with fortify, this is a denial of service, since Xorg
Proposed solution patch series can be found here:
In gentoo the effect should be a DoS, but the format string could be in system(s) where an user has disabled fortify.
Format string vulnerability in the LogVHdrMessageVerb function in os/log.c
in X.Org X11 1.11 allows attackers to cause a denial of service or possibly
execute arbitrary code via format string specifiers in an input device name.
This is now fixed in xorg-server-126.96.36.1992. However, I don't think that version is ready to go stable yet.
Upstream patch does not apply to xorg-server-1.11 and older.
Makes sense, thank you. Since xorg-server-188.8.131.522 is already ~arch, can we stabilize in say two weeks?
From Launchpad #996250 I took the patch for xorg-server-1.11 and added to xorg-server-1.11.4-r1 ebuild. That version should be better suited for stable right now.
The patch looks correct to me. However, I do not have the means to test whether it actually fixes the problem. Also neither upstream nor any other distribution applied this patch yet, which makes me a bit uncomfortable.
Ok, thanks. Is 1.11.4-r1 going to get much testing since there are higher versions at ~arch? I think we can wait a bit for testing, if it will actually get tested.
Adjusting severity per comment #1 (local privilege escalation in specific configurations).
Arches, please stabilize:
Target keywords: alpha amd64 arm hppa ia64 ~mips ppc ppc64 sh sparc x86 ~x86-fbsd
Would this require a net-misc/tigervnc bump or perhaps just an RDEPEND adjustment?
(In reply to comment #8)
It is not strictly needed, as tigervnc depends on xorg-server, not the other way round.
It is correct that this would make tigervnc users miss out on the security update though. Un-CC'ing arches until bug 418193 is fixed.
Bug 418193 has been resolved. Readding arches (and armin76 and x11).
Stable for HPPA.
Vulnerable versions have been removed from the tree.
xorg-server-1.9 is not affected by this issue.
Thanks, folks. GLSA request filed.
This issue was resolved and addressed in
GLSA 201207-04 at http://security.gentoo.org/glsa/glsa-201207-04.xml
by GLSA coordinator Sean Amoss (ackle).