Subject: bug#48039: closed (Re: bug#48039: xorg-server might be vulnerable to CVE-2021-3472)

From: [email-masked] (GNU bug Tracking System)
Date: Tue, 27 Apr 2021 06:04:02 +0000

Your bug report

#48039: xorg-server might be vulnerable to CVE-2021-3472

which was filed against the guix-patches package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
48039: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=48039
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#48039: xorg-server might be vulnerable to CVE-2021-3472
From: Leo Famulari <[email-masked]>
To: Nicolò Balzarotti <[email-masked]>
Cc: [email-masked]
Date: Tue, 27 Apr 2021 02:02:45 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

On Mon, Apr 26, 2021 at 03:33:33PM -0400, Leo Famulari wrote:
> I'm merging the two tickets. I think that updating the package is a
> better choice that simply patching it. I'll probably join our two
> patches together and push that.

Done as 6afe1543271637e3fd1eac82f5ec7af6975a47a5. Thanks for looking out
for these bugs!

Subject: xorg-server might be vulnerable to CVE-2021-3472
From: Nicolò Balzarotti <[email-masked]>
To: [email-masked]
Date: Mon, 26 Apr 2021 19:25:35 +0200
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi, just found this [fn:1]:

A flaw was found in xorg-x11-server in versions before 1.20.11. An
integer underflow can occur in xserver which can lead to a local
privilege escalation.

The commit fixing the bug should be the one at [fn:2], and latest tagged
version (1.20.11) should be fixed.

On a side note, the redhat issue tracker says that [fn:3]:

Xorg server does not run with root privileges in Red Hat Enterprise
Linux 8, therefore this flaw has been rated as having moderate impact
for Red Hat Enterprise linux 8.

Is it possible for guix too not to run the server as root?  I've no idea
myself

guix refresh -l xorg-server
Building the following 73 packages would ensure 121

I just rebuilt xorg-server itself with the attached patch, and building
other packages now but it might take some time on my server.  I'll let
you know how it goes.

[fn:1] https://nvd.nist.gov/vuln/detail/CVE-2021-3472
[fn:2]
https://gitlab.freedesktop.org/xorg/xserver/-/commit/7aaf54a1884f71dc363f0b884e57bcb67407a6cd
[fn:3] https://bugzilla.redhat.com/show_bug.cgi?id=1944167

>From a1767951a7b4631c48916f1171f577839fff0df3 Mon Sep 17 00:00:00 2001
From: nixo <[email-masked]>
Date: Mon, 26 Apr 2021 19:22:04 +0200
Subject: [PATCH] gnu: xorg-server: Update to 1.20.11.

* gnu/packages/xorg.scm (xorg-server): Update to 1.20.11.
---
 gnu/packages/xorg.scm | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm
index 97ff8ab92b..6b6fcbafa9 100644
--- a/gnu/packages/xorg.scm
+++ b/gnu/packages/xorg.scm
@@ -26,6 +26,7 @@
 ;;; Copyright © 2020, 2021 Michael Rohleder <[email-masked]>
 ;;; Copyright © 2020 Maxim Cournoyer <[email-masked]>
 ;;; Copyright © 2020 Jean-Baptiste Note <[email-masked]>
+;;; Copyright © 2021 Nicolò Balzarotti <[email-masked]>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -5302,7 +5303,7 @@ over Xlib, including:
 (define-public xorg-server
   (package
     (name "xorg-server")
-    (version "1.20.10")
+    (version "1.20.11")
     (source
       (origin
         (method url-fetch)
@@ -5310,7 +5311,7 @@ over Xlib, including:
                             "xorg-server-" version ".tar.bz2"))
         (sha256
          (base32
-          "16bwrf0ag41l7jbrllbix8z6avc5yimga7ihvq4ch3a5hb020x4p"))
+          "0jacqgin8kcyy8fyv0lhgb4if8g9hp60rm3ih3s1mgps7xp7jk4i"))
         (patches
          (list
           ;; See:
-- 
2.31.1