diff options
| author | Brian Paul <brianp@vmware.com> | 2019-10-09 12:05:16 -0600 |
|---|---|---|
| committer | Dylan Baker <dylan@pnwbakers.com> | 2019-11-20 08:24:09 -0800 |
| commit | 023ddb01b59467180357f7e4f104219e4b533e23 (patch) | |
| tree | f42a8e29ba4902a8ea923f1b1272ae114e23c499 | |
| parent | 3199172eaa703ac4c1fc3830c8e49c367725c3b8 (diff) | |
Call shmget() with permission 0600 instead of 0777
A security advisory (TALOS-2019-0857/CVE-2019-5068) found that
creating shared memory regions with permission mode 0777 could allow
any user to access that memory. Several Mesa drivers use shared-
memory XImages to implement back buffers for improved performance.
This path changes the shmget() calls to use 0600 (user r/w).
Tested with legacy Xlib driver and llvmpipe.
Cc: mesa-stable@lists.freedesktop.org
Reviewed-by: Kristian H. Kristensen <hoegsberg@google.com>
(cherry picked from commit 02c3dad0f3b4d26e0faa5cc51d06bc50d693dcdc)
| -rw-r--r-- | src/gallium/winsys/sw/dri/dri_sw_winsys.c | 3 | ||||
| -rw-r--r-- | src/gallium/winsys/sw/xlib/xlib_sw_winsys.c | 3 | ||||
| -rw-r--r-- | src/mesa/drivers/x11/xm_buffer.c | 3 |
3 files changed, 6 insertions, 3 deletions
diff --git a/src/gallium/winsys/sw/dri/dri_sw_winsys.c b/src/gallium/winsys/sw/dri/dri_sw_winsys.c index 761f5d19f54..2e5970ba32d 100644 --- a/src/gallium/winsys/sw/dri/dri_sw_winsys.c +++ b/src/gallium/winsys/sw/dri/dri_sw_winsys.c @@ -92,7 +92,8 @@ alloc_shm(struct dri_sw_displaytarget *dri_sw_dt, unsigned size) { char *addr; - dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777); + /* 0600 = user read+write */ + dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600); if (dri_sw_dt->shmid < 0) return NULL; diff --git a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c index c14c9de4350..edebb48bb85 100644 --- a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c +++ b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c @@ -126,7 +126,8 @@ alloc_shm(struct xlib_displaytarget *buf, unsigned size) shminfo->shmid = -1; shminfo->shmaddr = (char *) -1; - shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777); + /* 0600 = user read+write */ + shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600); if (shminfo->shmid < 0) { return NULL; } diff --git a/src/mesa/drivers/x11/xm_buffer.c b/src/mesa/drivers/x11/xm_buffer.c index d945d8af556..0da08a6e64d 100644 --- a/src/mesa/drivers/x11/xm_buffer.c +++ b/src/mesa/drivers/x11/xm_buffer.c @@ -89,8 +89,9 @@ alloc_back_shm_ximage(XMesaBuffer b, GLuint width, GLuint height) return GL_FALSE; } + /* 0600 = user read+write */ b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line - * b->backxrb->ximage->height, IPC_CREAT|0777); + * b->backxrb->ximage->height, IPC_CREAT | 0600); if (b->shminfo.shmid < 0) { _mesa_warning(NULL, "shmget failed while allocating back buffer.\n"); XDestroyImage(b->backxrb->ximage); |