You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
53 lines
1.8 KiB
53 lines
1.8 KiB
From 2fda7c57e7ebe210cf5e2bb051a0a9271f85e80a Mon Sep 17 00:00:00 2001 |
|
From: Matthieu Herrb <matthieu@herrb.eu> |
|
Date: Mon, 22 Oct 2018 14:33:25 -0400 |
|
Subject: [PATCH xserver] Disable -logfile and -modulepath when running with |
|
elevated privileges |
|
|
|
An unprivileged user was able to overwrite arbitrary files |
|
in directories in which it is able to chdir, potentially |
|
leading to privilege elevation. |
|
|
|
CVE-2018-14665 |
|
|
|
An unprivileded user was able to load arbitrary modules |
|
from user controlled directories, leading to privilege |
|
elevation. |
|
|
|
CVE-2018-XXXXX |
|
|
|
Issues reported by Narendra Shinde |
|
|
|
Signed-off-by: Matthieu Herrb <matthieu@herrb.eu> |
|
Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> |
|
--- |
|
hw/xfree86/common/xf86Init.c | 8 ++++++-- |
|
1 file changed, 6 insertions(+), 2 deletions(-) |
|
|
|
diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c |
|
index 6c25eda739..0f57efa863 100644 |
|
--- a/hw/xfree86/common/xf86Init.c |
|
+++ b/hw/xfree86/common/xf86Init.c |
|
@@ -935,14 +935,18 @@ ddxProcessArgument(int argc, char **argv, int i) |
|
/* First the options that are not allowed with elevated privileges */ |
|
if (!strcmp(argv[i], "-modulepath")) { |
|
CHECK_FOR_REQUIRED_ARGUMENT(); |
|
- xf86CheckPrivs(argv[i], argv[i + 1]); |
|
+ if (xf86PrivsElevated()) |
|
+ FatalError("\nInvalid argument -modulepath " |
|
+ "with elevated privileges\n"); |
|
xf86ModulePath = argv[i + 1]; |
|
xf86ModPathFrom = X_CMDLINE; |
|
return 2; |
|
} |
|
if (!strcmp(argv[i], "-logfile")) { |
|
CHECK_FOR_REQUIRED_ARGUMENT(); |
|
- xf86CheckPrivs(argv[i], argv[i + 1]); |
|
+ if (xf86PrivsElevated()) |
|
+ FatalError("\nInvalid argument -logfile " |
|
+ "with elevated privileges\n"); |
|
xf86LogFile = argv[i + 1]; |
|
xf86LogFileFrom = X_CMDLINE; |
|
return 2; |
|
-- |
|
2.19.0
|
|
|