David Fries
2009-Aug-03 02:18 UTC
[Secure-testing-team] Bug#539699: xscreensaver: unlocked because killed, infinite loop with small screen
Package: xscreensaver Version: 5.05-3 Severity: grave Tags: security patch Justification: user security hole Reproduce by setting a narrow X resolution, in this case I was running Xnest at 410x384, type something to get the password dialog, but it never comes up. xscreensaver goes into an infinite loop eating memory, and the one time I let it run, the Linux kernel out of memory detector killed xscreensaver unlocking the X server. That''s why I marked this with the security tags. Do any hardware and X software automatically pick up and use newly plugged in displays? If so, it might be exploited by, plugging in a custom display device with a small screen, and use this exploit to kill the screen saver get access to the system, then restart the xscreensaver to make detection more difficult. The problem is when mlstring_wrap detects a space will copy the whitespace on to a new line and then truncate the original string for the current line. If in the next iteration the line is still too long, and the current whitespace character is the first one encountered it is in an infinite loop finding the same whitespace character. In my case line_length is 5, and the string is "Please enter your password." This patch will leave the whitespace in the previous line so it can''t be found the next iteration. It will also make the previous line too wide, but only the whitespace would be over the border. On a site note it might be a good idea to always put the logo on the right side, or put it on the right side when the width is too small. With the patch at 410 pixels wide the logo takes up almost all of the screen and the text is just visible at the right side. diff --git a/driver/mlstring.c b/driver/mlstring.c index d6df844..a850890 100644 --- a/driver/mlstring.c +++ b/driver/mlstring.c @@ -153,6 +153,8 @@ mlstring_wrap(mlstring *mstring, XFontStruct *font, Dimension width) if (wrap_at == -1) /* No space found, hard wrap */ wrap_at = line_length; + else + wrap_at++; /* Leave the space at the end of the line. */ newml = calloc(1, sizeof(*newml)); if (!newml) /* OOM, don''t bother trying to wrap */ -- System Information: Debian Release: 5.0.2 APT prefers stable APT policy: (500, ''stable'') Architecture: i386 (i586) Kernel: Linux 2.6.29-rc3 Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/bash Versions of packages xscreensaver depends on: ii libatk1.0-0 1.22.0-1 The ATK accessibility toolkit ii libc6 2.7-18 GNU C Library: Shared libraries ii libcairo2 1.6.4-7 The Cairo 2D vector graphics libra ii libglade2-0 1:2.6.2-1 library to load .glade files at ru ii libglib2.0-0 2.16.6-2 The GLib library of C routines ii libgtk2.0-0 2.12.12-1~lenny1 The GTK+ graphical user interface ii libice6 2:1.0.4-1 X11 Inter-Client Exchange library ii libpam0g 1.0.1-5+lenny1 Pluggable Authentication Modules l ii libpango1.0-0 1.20.5-5 Layout and rendering of internatio ii libsm6 2:1.0.3-2 X11 Session Management library ii libx11-6 2:1.1.5-2 X11 client-side library ii libxext6 2:1.0.4-1 X11 miscellaneous extension librar ii libxinerama1 2:1.0.3-2 X11 Xinerama extension library ii libxml2 2.6.32.dfsg-5 GNOME XML library ii libxmu6 2:1.0.4-1 X11 miscellaneous utility library ii libxpm4 1:3.5.7-1 X11 pixmap library ii libxrandr2 2:1.2.3-1 X11 RandR extension library ii libxrender1 1:0.9.4-2 X Rendering Extension client libra ii libxt6 1:1.0.5-3 X11 toolkit intrinsics library ii libxxf86misc1 1:1.0.1-3 X11 XFree86 miscellaneous extensio ii libxxf86vm1 1:1.0.2-1 X11 XFree86 video mode extension l ii xscreensaver-data 5.05-3 data files to be shared among scre Versions of packages xscreensaver recommends: ii libjpeg-progs 6b-14 Programs for manipulating JPEG fil ii perl [perl5] 5.10.0-19 Larry Wall''s Practical Extraction ii wamerican [wordlist] 6-2.3 American English dictionary words pn xli | xloadimage <none> (no description available) Versions of packages xscreensaver suggests: ii fortune-mod [fortune] 1:1.99.1-3.1 provides fortune cookies on demand ii iceape-browser [www-bro 1.1.14-1 Iceape Navigator (Internet browser ii iceweasel [www-browser] 3.0.6-1 lightweight web browser based on M ii konqueror [www-browser] 4:3.5.9.dfsg.1-6 KDE''s advanced file manager, web b ii lynx-cur [www-browser] 2.8.7dev9-2.1 Text-mode WWW Browser with NLS sup ii streamer 3.95.dfsg.1-8 television capture tool (images/mo pn xdaliclock <none> (no description available) pn xfishtank <none> (no description available) pn xscreensaver-gl <none> (no description available) -- no debconf information