From 50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e Mon Sep 17 00:00:00 2001 From: Matthieu Herrb Date: Tue, 23 Oct 2018 21:29:08 +0200 Subject: Disable -logfile and -modulepath when running with elevated privileges Could cause privilege elevation and/or arbitrary files overwrite, when the X server is running with elevated privileges (ie when Xorg is installed with the setuid bit set and started by a non-root user). CVE-2018-14665 Issue reported by Narendra Shinde and Red Hat. Signed-off-by: Matthieu Herrb Reviewed-by: Alan Coopersmith Reviewed-by: Peter Hutterer Reviewed-by: Adam Jackson --- hw/xfree86/common/xf86Init.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'hw/xfree86/common/xf86Init.c') diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c index 6c25eda73..0f57efa86 100644 --- a/hw/xfree86/common/xf86Init.c +++ b/hw/xfree86/common/xf86Init.c @@ -935,14 +935,18 @@ ddxProcessArgument(int argc, char **argv, int i) /* First the options that are not allowed with elevated privileges */ if (!strcmp(argv[i], "-modulepath")) { CHECK_FOR_REQUIRED_ARGUMENT(); - xf86CheckPrivs(argv[i], argv[i + 1]); + if (xf86PrivsElevated()) + FatalError("\nInvalid argument -modulepath " + "with elevated privileges\n"); xf86ModulePath = argv[i + 1]; xf86ModPathFrom = X_CMDLINE; return 2; } if (!strcmp(argv[i], "-logfile")) { CHECK_FOR_REQUIRED_ARGUMENT(); - xf86CheckPrivs(argv[i], argv[i + 1]); + if (xf86PrivsElevated()) + FatalError("\nInvalid argument -logfile " + "with elevated privileges\n"); xf86LogFile = argv[i + 1]; xf86LogFileFrom = X_CMDLINE; return 2; -- cgit v1.2.3