#48039 xorg-server might be vulnerable to CVE-2021-3472

Message #5 received at submit@debbugs.gnu.org (full text, mbox, reply):

From: Nicolò Balzarotti <anothersms@gmail.com>

To: bug-guix@gnu.org

Subject: xorg-server might be vulnerable to CVE-2021-3472

Date: Mon, 26 Apr 2021 19:25:35 +0200

[Message part 1 (text/plain, inline)]

Hi, just found this [fn:1]:

A flaw was found in xorg-x11-server in versions before 1.20.11. An
integer underflow can occur in xserver which can lead to a local
privilege escalation.

The commit fixing the bug should be the one at [fn:2], and latest tagged
version (1.20.11) should be fixed.

On a side note, the redhat issue tracker says that [fn:3]:

Xorg server does not run with root privileges in Red Hat Enterprise
Linux 8, therefore this flaw has been rated as having moderate impact
for Red Hat Enterprise linux 8.

Is it possible for guix too not to run the server as root?  I've no idea
myself

guix refresh -l xorg-server
Building the following 73 packages would ensure 121

I just rebuilt xorg-server itself with the attached patch, and building
other packages now but it might take some time on my server.  I'll let
you know how it goes.

[fn:1] https://nvd.nist.gov/vuln/detail/CVE-2021-3472
[fn:2]
https://gitlab.freedesktop.org/xorg/xserver/-/commit/7aaf54a1884f71dc363f0b884e57bcb67407a6cd
[fn:3] https://bugzilla.redhat.com/show_bug.cgi?id=1944167

[0001-gnu-xorg-server-Update-to-1.20.11.patch (text/x-patch, attachment)]

Message #10 received at 48039@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: Nicolò Balzarotti <anothersms@gmail.com>

Cc: 48039@debbugs.gnu.org

Subject: Re: bug#48039: xorg-server might be vulnerable to CVE-2021-3472

Date: Mon, 26 Apr 2021 13:35:24 -0400

[Message part 1 (text/plain, inline)]

On Mon, Apr 26, 2021 at 07:25:35PM +0200, Nicolò Balzarotti wrote:
> From a1767951a7b4631c48916f1171f577839fff0df3 Mon Sep 17 00:00:00 2001
> From: nixo <nicolo@nixo.xyz>
> Date: Mon, 26 Apr 2021 19:22:04 +0200
> Subject: [PATCH] gnu: xorg-server: Update to 1.20.11.
> 
> * gnu/packages/xorg.scm (xorg-server): Update to 1.20.11.

Did you see <https://bugs.gnu.org/48001>?

We should push a fix for this bug along with
<https://bugs.gnu.org/48000>, since the GStreamer plugins depend on
xorg-server. Otherwise we'll have to rebuild all effected packages
twice.

[signature.asc (application/pgp-signature, inline)]

Message #13 received at 48039@debbugs.gnu.org (full text, mbox, reply):

From: Nicolò Balzarotti <anothersms@gmail.com>

To: Leo Famulari <leo@famulari.name>

Cc: 48039@debbugs.gnu.org

Subject: Re: bug#48039: xorg-server might be vulnerable to CVE-2021-3472

Date: Mon, 26 Apr 2021 20:27:58 +0200

Leo Famulari <leo@famulari.name> writes:

> On Mon, Apr 26, 2021 at 07:25:35PM +0200, Nicolò Balzarotti wrote:
>> * gnu/packages/xorg.scm (xorg-server): Update to 1.20.11.
>
> Did you see <https://bugs.gnu.org/48001>?
>
Ops, sorry for the duplicate, I somehow missed it, I'm closing this

Thanks!

Message #18 received at 48039-close@debbugs.gnu.org (full text, mbox, reply):

From: Nicolò Balzarotti <anothersms@gmail.com>

To: 48039-close@debbugs.gnu.org

Date: Mon, 26 Apr 2021 20:28:47 +0200

Message #27 received at 48039@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: Nicolò Balzarotti <anothersms@gmail.com>

Cc: 48039@debbugs.gnu.org

Subject: Re: bug#48039: xorg-server might be vulnerable to CVE-2021-3472

Date: Mon, 26 Apr 2021 15:33:33 -0400

On Mon, Apr 26, 2021 at 08:27:58PM +0200, Nicolò Balzarotti wrote:
> Leo Famulari <leo@famulari.name> writes:
> 
> > On Mon, Apr 26, 2021 at 07:25:35PM +0200, Nicolò Balzarotti wrote:
> >> * gnu/packages/xorg.scm (xorg-server): Update to 1.20.11.
> >
> > Did you see <https://bugs.gnu.org/48001>?
> >
> Ops, sorry for the duplicate, I somehow missed it, I'm closing this

I didn't mean for you to close your message.

We took different approaches to fixing the bug: I applied a patch, and
you updated the package.

The big difference is that your patch doesn't avoid changing the
xorg-server-for-tests package, so it can't be applied to master.

I'm merging the two tickets. I think that updating the package is a
better choice that simply patching it. I'll probably join our two
patches together and push that.

Message #32 received at 48039-done@debbugs.gnu.org (full text, mbox, reply):

From: Leo Famulari <leo@famulari.name>

To: Nicolò Balzarotti <anothersms@gmail.com>

Cc: 48039-done@debbugs.gnu.org

Subject: Re: bug#48039: xorg-server might be vulnerable to CVE-2021-3472

Date: Tue, 27 Apr 2021 02:02:45 -0400

[Message part 1 (text/plain, inline)]

On Mon, Apr 26, 2021 at 03:33:33PM -0400, Leo Famulari wrote:
> I'm merging the two tickets. I think that updating the package is a
> better choice that simply patching it. I'll probably join our two
> patches together and push that.

Done as 6afe1543271637e3fd1eac82f5ec7af6975a47a5. Thanks for looking out
for these bugs!

[signature.asc (application/pgp-signature, inline)]

Message #40 received at 48039-done@debbugs.gnu.org (full text, mbox, reply):

From: Nicolò Balzarotti <anothersms@gmail.com>

To: Leo Famulari <leo@famulari.name>

Cc: 48039-done@debbugs.gnu.org

Subject: Re: bug#48039: xorg-server might be vulnerable to CVE-2021-3472

Date: Tue, 27 Apr 2021 09:18:42 +0200

Leo Famulari <leo@famulari.name> writes:

> On Mon, Apr 26, 2021 at 03:33:33PM -0400, Leo Famulari wrote:
>> I'm merging the two tickets. I think that updating the package is a
>> better choice that simply patching it. I'll probably join our two
>> patches together and push that.
>
> Done as 6afe1543271637e3fd1eac82f5ec7af6975a47a5. Thanks for looking out
> for these bugs!
Thank you!

Send a report that this bug log contains spam.