File u_call-shmget-with-permission-0600-instead-of-0777.patch of Package Mesa.18651
A security advisory (TALOS-2019-0857/CVE-2019-5068) found that
creating shared memory regions with permission mode 0777 could allow
any user to access that memory. Several Mesa drivers use shared-
memory XImages to implement back buffers for improved performance.
This path changes the shmget() calls to use 0600 (user r/w).
Tested with legacy Xlib driver and llvmpipe.
Cc: <a href="https://lists.freedesktop.org/mailman/listinfo/mesa-dev">mesa-stable at lists.freedesktop.org</a>
---
src/gallium/winsys/sw/dri/dri_sw_winsys.c | 3 ++-
src/gallium/winsys/sw/xlib/xlib_sw_winsys.c | 3 ++-
src/mesa/drivers/x11/xm_buffer.c | 3 ++-
3 files changed, 6 insertions(+), 3 deletions(-)
Index: mesa-18.0.2/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
===================================================================
--- mesa-18.0.2.orig/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
+++ mesa-18.0.2/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c
@@ -126,7 +126,8 @@ alloc_shm(struct xlib_displaytarget *buf
shminfo->shmid = -1;
shminfo->shmaddr = (char *) -1;
- shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777);
+ /* 0600 = user read+write */
+ shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0600);
if (shminfo->shmid < 0) {
return NULL;
}
Index: mesa-18.0.2/src/mesa/drivers/x11/xm_buffer.c
===================================================================
--- mesa-18.0.2.orig/src/mesa/drivers/x11/xm_buffer.c
+++ mesa-18.0.2/src/mesa/drivers/x11/xm_buffer.c
@@ -88,8 +88,9 @@ alloc_back_shm_ximage(XMesaBuffer b, GLu
return GL_FALSE;
}
+ /* 0600 = user read+write */
b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line
- * b->backxrb->ximage->height, IPC_CREAT|0777);
+ * b->backxrb->ximage->height, IPC_CREAT|0600);
if (b->shminfo.shmid < 0) {
_mesa_warning(NULL, "shmget failed while allocating back buffer.\n");
XDestroyImage(b->backxrb->ximage);