<div dir="ltr"><div>Ping. Anyone?</div><div> </div><div>-Brian </div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Oct 22, 2019 at 3:52 PM Brian Paul <<a href="mailto:brianp@vmware.com">brianp@vmware.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">A security advisory (TALOS-2019-0857/CVE-2019-5068) found that creating shared memory regions with permission mode 0777 could allow any user to access that memory. Several Mesa drivers use shared- memory XImages to implement back buffers for improved performance. This path changes the shmget() calls to use 0600 (user r/w). Tested with legacy Xlib driver and llvmpipe. Cc: <a href="mailto:mesa-stable@lists.freedesktop.org" target="_blank">mesa-stable@lists.freedesktop.org</a> --- src/gallium/winsys/sw/dri/dri_sw_winsys.c | 3 ++- src/gallium/winsys/sw/xlib/xlib_sw_winsys.c | 3 ++- src/mesa/drivers/x11/xm_buffer.c | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/gallium/winsys/sw/dri/dri_sw_winsys.c b/src/gallium/winsys/sw/dri/dri_sw_winsys.c index 761f5d1..2e5970b 100644 --- a/src/gallium/winsys/sw/dri/dri_sw_winsys.c +++ b/src/gallium/winsys/sw/dri/dri_sw_winsys.c @@ -92,7 +92,8 @@ alloc_shm(struct dri_sw_displaytarget *dri_sw_dt, unsigned size) { char *addr; - dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777); + /* 0600 = user read+write */ + dri_sw_dt->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600); if (dri_sw_dt->shmid < 0) return NULL; diff --git a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c index c14c9de..edebb48 100644 --- a/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c +++ b/src/gallium/winsys/sw/xlib/xlib_sw_winsys.c @@ -126,7 +126,8 @@ alloc_shm(struct xlib_displaytarget *buf, unsigned size) shminfo->shmid = -1; shminfo->shmaddr = (char *) -1; - shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT|0777); + /* 0600 = user read+write */ + shminfo->shmid = shmget(IPC_PRIVATE, size, IPC_CREAT | 0600); if (shminfo->shmid < 0) { return NULL; } diff --git a/src/mesa/drivers/x11/xm_buffer.c b/src/mesa/drivers/x11/xm_buffer.c index d945d8a..0da08a6 100644 --- a/src/mesa/drivers/x11/xm_buffer.c +++ b/src/mesa/drivers/x11/xm_buffer.c @@ -89,8 +89,9 @@ alloc_back_shm_ximage(XMesaBuffer b, GLuint width, GLuint height) return GL_FALSE; } + /* 0600 = user read+write */ b->shminfo.shmid = shmget(IPC_PRIVATE, b->backxrb->ximage->bytes_per_line - * b->backxrb->ximage->height, IPC_CREAT|0777); + * b->backxrb->ximage->height, IPC_CREAT | 0600); if (b->shminfo.shmid < 0) { _mesa_warning(NULL, "shmget failed while allocating back buffer.\n"); XDestroyImage(b->backxrb->ximage); -- 1.8.5.6 _______________________________________________ mesa-dev mailing list <a href="mailto:mesa-dev@lists.freedesktop.org" target="_blank">mesa-dev@lists.freedesktop.org</a> <a href="https://lists.freedesktop.org/mailman/listinfo/mesa-dev" rel="noreferrer" target="_blank">https://lists.freedesktop.org/mailman/listinfo/mesa-dev</a></blockquote></div></div>