From 2fda7c57e7ebe210cf5e2bb051a0a9271f85e80a Mon Sep 17 00:00:00 2001 From: Matthieu Herrb Date: Mon, 22 Oct 2018 14:33:25 -0400 Subject: [PATCH xserver] Disable -logfile and -modulepath when running with elevated privileges An unprivileged user was able to overwrite arbitrary files in directories in which it is able to chdir, potentially leading to privilege elevation. CVE-2018-14665 An unprivileded user was able to load arbitrary modules from user controlled directories, leading to privilege elevation. CVE-2018-XXXXX Issues reported by Narendra Shinde Signed-off-by: Matthieu Herrb Reviewed-by: Alan Coopersmith --- hw/xfree86/common/xf86Init.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c index 6c25eda739..0f57efa863 100644 --- a/hw/xfree86/common/xf86Init.c +++ b/hw/xfree86/common/xf86Init.c @@ -935,14 +935,18 @@ ddxProcessArgument(int argc, char **argv, int i) /* First the options that are not allowed with elevated privileges */ if (!strcmp(argv[i], "-modulepath")) { CHECK_FOR_REQUIRED_ARGUMENT(); - xf86CheckPrivs(argv[i], argv[i + 1]); + if (xf86PrivsElevated()) + FatalError("\nInvalid argument -modulepath " + "with elevated privileges\n"); xf86ModulePath = argv[i + 1]; xf86ModPathFrom = X_CMDLINE; return 2; } if (!strcmp(argv[i], "-logfile")) { CHECK_FOR_REQUIRED_ARGUMENT(); - xf86CheckPrivs(argv[i], argv[i + 1]); + if (xf86PrivsElevated()) + FatalError("\nInvalid argument -logfile " + "with elevated privileges\n"); xf86LogFile = argv[i + 1]; xf86LogFileFrom = X_CMDLINE; return 2; -- 2.19.0