6aa00ecd4e
CVE-2020-14346, CVE-2020-14361, CVE-2020-14362 Multiple input validation failures in X server extensions ========================================================= All theses issuses can lead to local privileges elevation on systems where the X server is running privileged. * CVE-2020-14345 / ZDI CAN 11428 XkbSetNames Out-Of-Bounds Access The handler for the XkbSetNames request does not validate the request length before accessing its contents. * CVE-2020-14346 / ZDI CAN 11429 XIChangeHierarchy Integer Underflow An integer underflow exists in the handler for the XIChangeHierarchy request. * CVE-2020-14361 / ZDI CAN 11573 XkbSelectEvents Integer Underflow An integer underflow exist in the handler for the XkbSelectEvents request. * CVE-2020-1436 / ZDI CAN 11574 XRecordRegisterClients Integer Underflow An integer underflow exist in the handler for the CreateRegister request of the X record extension.
WARNING: If you fail to rebuild input and video packages for xorg-server on major ABI changes, eg. 1.16.0 -> 1.17.0. You will end up with no mouse or keyboard and possibly no direct 3D acceleration for video. If you do happen to forget and have sys-rq enabled in your kernel you can do a safe reboot with holding down Alt + SysRq, and typing the following sequence in order, pausing for several seconds between each key: reisub PRE-INSTALL xorg-server 1.16 new dependency libepoxy xorg-server 1.16 removed dependency xorg-glamor-egl xorg-server 1.17 new dependency xorg-xcb-util-keysyms xorg-server 1.17 removed dependency xorg-xf86-video-modesetting The current version of xorg-server needs these packages sorted out before a prt-get sysup from crux 3.1 release is done. prt-get remove xorg-xf86-video-modesetting xorg-glamor-egl prt-get depinst libepoxy xorg-xcb-util-keysyms POST-INSTALL After upgrading xorg-server, from major versions rebuild video and input packages: NOTE: This only applies on ABI changes between major versions eg, 1.16.0 -> 1.17.0. prt-get update -fr $(prt-get listinst --regex '^xorg-xf86-(input|video)|^mesa3d') If you use nvidia you also need to do this: gl-select use xorg && gl-select use nvidia