已开启
fix(cve): 修复 CVE-2026-50261 在 xorg-x11-server 中的漏洞 #398
infra_team创建于 6月8日
fix(cve): 修复 CVE-2026-50261 在 xorg-x11-server 中的漏洞 #398
已开启
共 2 个文件变更+57-1
| @@ -0,0 +1,51 @@ | |||
| 1 | +From: Povilas Kanapickas <povilas@radix.lt> | ||
| 2 | +Date: Tue, 27 May 2025 01:38:35 +0300 | ||
| 3 | +Subject: [PATCH] fix: CVE-2026-50261 - Xext/sync: restart trigger list iteration after TriggerFired | ||
| 4 | + | ||
| 5 | +fix: CVE-2026-50261 - Xext/sync: restart trigger list iteration after TriggerFired | ||
| 6 | + | ||
| 7 | +SyncChangeCounter() iterates over the trigger list and calls | ||
| 8 | +TriggerFired() for each matching trigger. TriggerFired() may free the | ||
| 9 | +current element of the trigger list, causing a use-after-free when the | ||
| 10 | +loop continues to the next element via the previously saved pnext | ||
| 11 | +pointer. | ||
| 12 | + | ||
| 13 | +Fix this by restarting the iteration from the beginning of the trigger | ||
| 14 | +list after each TriggerFired() call. This is safe because the counter | ||
| 15 | +value has already been updated and CheckTrigger() will not fire for | ||
| 16 | +triggers that have already been processed (their state is updated by | ||
| 17 | +TriggerFired()). | ||
| 18 | + | ||
| 19 | +Upstream-commit: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bdd7bf57af208b1ddf57d4683d67104443b44812 | ||
| 20 | +Signed-off-by: infra_team <zhaiwenjie1@huawei.com> | ||
| 21 | +--- | ||
| 22 | + Xext/sync.c | 12 +++++++++--- | ||
| 23 | + 1 file changed, 9 insertions(+), 3 deletions(-) | ||
| 24 | + | ||
| 25 | +--- a/Xext/sync.c | ||
| 26 | ++++ b/Xext/sync.c | ||
| 27 | + SyncUpdateCounter(SyncCounter *pCounter, int64_t newval) | ||
| 28 | + void | ||
| 29 | + SyncChangeCounter(SyncCounter * pCounter, int64_t newval) | ||
| 30 | + { | ||
| 31 | +- SyncTriggerList *ptl, *pnext; | ||
| 32 | ++ SyncTriggerList *ptl; | ||
| 33 | + int64_t oldval; | ||
| 34 | + | ||
| 35 | + oldval = SyncUpdateCounter(pCounter, newval); | ||
| 36 | + | ||
| 37 | + /* run through triggers to see if any become true */ | ||
| 38 | +- for (ptl = pCounter->sync.pTriglist; ptl; ptl = pnext) { | ||
| 39 | +- pnext = ptl->next; | ||
| 40 | +- if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval)) | ||
| 41 | ++ ptl = pCounter->sync.pTriglist; | ||
| 42 | ++ while (ptl) { | ||
| 43 | ++ if ((*ptl->pTrigger->CheckTrigger) (ptl->pTrigger, oldval)) { | ||
| 44 | + (*ptl->pTrigger->TriggerFired) (ptl->pTrigger); | ||
| 45 | ++ ptl = pCounter->sync.pTriglist; | ||
| 46 | ++ } else { | ||
| 47 | ++ ptl = ptl->next; | ||
| 48 | ++ } | ||
| 49 | + } | ||
| 50 | + | ||
| 51 | + if (IsSystemCounter(pCounter)) { | ||
| @@ -16,7 +16,7 @@ | |||
| 16 | 16 | ||
| 17 | Name: xorg-x11-server | 17 | Name: xorg-x11-server |
| 18 | Version: 1.20.11 | 18 | Version: 1.20.11 |
| 19 | -Release: 46 | 19 | +Release: 47 |
| 20 | Summary: X.Org X11 X server | 20 | Summary: X.Org X11 X server |
| 21 | License: MIT and GPLv2 | 21 | License: MIT and GPLv2 |
| 22 | URL: https://www.x.org | 22 | URL: https://www.x.org |
| @@ -160,6 +160,7 @@ Patch6073: backport-CVE-2026-34002.patch | |||
| 160 | Patch6074: backport-0001-CVE-2026-34003.patch | 160 | Patch6074: backport-0001-CVE-2026-34003.patch |
| 161 | Patch6075: backport-0002-CVE-2026-34003.patch | 161 | Patch6075: backport-0002-CVE-2026-34003.patch |
| 162 | Patch6076: backport-os-fix-sha1-build-error-with-Nettle-4.0.patch | 162 | Patch6076: backport-os-fix-sha1-build-error-with-Nettle-4.0.patch |
| 163 | +Patch6077: backport-CVE-2026-50261.patch | ||
| 163 | 164 | ||
| 164 | BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc | 165 | BuildRequires: audit-libs-devel autoconf automake bison dbus-devel flex git gcc |
| 165 | BuildRequires: systemtap-sdt-devel libtool pkgconfig | 166 | BuildRequires: systemtap-sdt-devel libtool pkgconfig |
| @@ -498,6 +499,10 @@ find %{inst_srcdir}/hw/xfree86 -name \*.c -delete | |||
| 498 | %{_mandir}/man*/* | 499 | %{_mandir}/man*/* |
| 499 | 500 | ||
| 500 | %changelog | 501 | %changelog |
| 502 | +* Mon Jun 08 2026 infra_team <zhaiwenjie1@huawei.com> - 1.20.11-47 | ||
| 503 | +- fix CVE: CVE-2026-50261 | ||
| 504 | +- Xext/sync: restart trigger list iteration after TriggerFired to fix use-after-free | ||
| 505 | + | ||
| 501 | * Mon May 18 2026 Funda Wang <fundawang@yeah.net> - 1.20.11-46 | 506 | * Mon May 18 2026 Funda Wang <fundawang@yeah.net> - 1.20.11-46 |
| 502 | - fix build with nettle 4.0 (downstream required for tigervnc) | 507 | - fix build with nettle 4.0 (downstream required for tigervnc) |
| 503 | 508 | ||