Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 31 Jul 2020 16:04:21 +0200
From: Matthieu Herrb <>
Subject: Fwd: X.Org security advisory: July 31, 2020: Xserver

----- Forwarded message from Matthieu Herrb <> -----

Date: Fri, 31 Jul 2020 15:44:44 +0200
From: Matthieu Herrb <>
Subject: X.Org security advisory: July 31, 2020: Xserver

X.Org security advisory: July 31, 2020

X Server Pixel Data Uninitialized Memory Information Disclosure 


Allocation for pixmap data in AllocatePixmap() does not initialize the
memory in xserver, it leads to leak uninitialize heap memory to
clients. When the X server runs with elevated privileges.

This flaw can lead to ASLR bypass, which when combined with other
flaws (known/unknown) could lead to lead to privilege elevation in the


A patch for this issue has been commited to the xorg server git
repository.  xorg-server 1.20.9 will be released shortly and will
include this patch.

diff --git a/dix/pixmap.c b/dix/pixmap.c
index 1186d7dbb..5a0146bbb 100644
--- a/dix/pixmap.c
+++ b/dix/pixmap.c
@@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
     if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize)
         return NullPixmap;
-    pPixmap = malloc(pScreen->totalPixmapSize + pixDataSize);
+    pPixmap = calloc(1, pScreen->totalPixmapSize + pixDataSize);
     if (!pPixmap)
         return NullPixmap;

This vulnerability was discovered by Jan-Niklas Sohn working with
Trend Micro Zero Day Initiative.

Matthieu Herrb

xorg-announce mailing list

----- End forwarded message -----

Download attachment "signature.asc" of type "application/pgp-signature" (794 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.