qbit/xenocara
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Call shmget() with permission 0600 instead of 0777

Browse Source 
From Brian Paul
02c3dad0f3b4d26e0faa5cc51d06bc50d693dcdc in mainline Mesa

"A security advisory (TALOS-2019-0857/CVE-2019-5068) found that
creating shared memory regions with permission mode 0777 could allow
any user to access that memory.  Several Mesa drivers use shared-
memory XImages to implement back buffers for improved performance.

This path changes the shmget() calls to use 0600 (user r/w).

Tested with legacy Xlib driver and llvmpipe."
This commit is contained in:
jsg 2019-11-20 03:13:04 +00:00
parent 1d6efe8e23
commit 76ee08e832
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/mesa/src/gallium/winsys/sw/dri/dri_sw_winsys.c
View File

@ -93,7 +93,8 @@ alloc_shm(struct dri_sw_displaytarget *dri_sw_dt, unsigned size)
{ {
char *addr; char *addr;
dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777); /* 0600 = user read+write */
dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600);
if (dri_sw_dt->shmid < 0) if (dri_sw_dt->shmid < 0)
return NULL; return NULL;

3
lib/mesa/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
View File

@ -126,7 +126,8 @@ alloc_shm(struct xlib_displaytarget *buf, unsigned size)
shminfo->shmid = -1; shminfo->shmid = -1;
shminfo->shmaddr = (char *) -1; shminfo->shmaddr = (char *) -1;
shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777); /* 0600 = user read+write */
shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600);
if (shminfo->shmid < 0) { if (shminfo->shmid < 0) {
return NULL; return NULL;
} }

3
lib/mesa/src/mesa/drivers/x11/xm_buffer.c
View File

@ -89,8 +89,9 @@ alloc_back_shm_ximage(XMesaBuffer b, GLuint width, GLuint height)
return GL_FALSE; return GL_FALSE;
} }
/* 0600 = user read+write */
b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line
* b->backxrb->ximage->height, IPC_CREAT|0777); * b->backxrb->ximage->height, IPC_CREAT | 0600);
if (b->shminfo.shmid < 0) { if (b->shminfo.shmid < 0) {
_mesa_warning(NULL, "shmget failed while allocating back buffer.\n"); _mesa_warning(NULL, "shmget failed while allocating back buffer.\n");
XDestroyImage(b->backxrb->ximage); XDestroyImage(b->backxrb->ximage);