Hi, just found this [fn:1]: A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation.
The commit fixing the bug should be the one at [fn:2], and latest tagged version (1.20.11) should be fixed. On a side note, the redhat issue tracker says that [fn:3]: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8, therefore this flaw has been rated as having moderate impact for Red Hat Enterprise linux 8. Is it possible for guix too not to run the server as root? I've no idea myself guix refresh -l xorg-server Building the following 73 packages would ensure 121 I just rebuilt xorg-server itself with the attached patch, and building other packages now but it might take some time on my server. I'll let you know how it goes. [fn:1] https://nvd.nist.gov/vuln/detail/CVE-2021-3472 [fn:2] https://gitlab.freedesktop.org/xorg/xserver/-/commit/7aaf54a1884f71dc363f0b884e57bcb67407a6cd [fn:3] https://bugzilla.redhat.com/show_bug.cgi?id=1944167
>From a1767951a7b4631c48916f1171f577839fff0df3 Mon Sep 17 00:00:00 2001 From: nixo <[email protected]> Date: Mon, 26 Apr 2021 19:22:04 +0200 Subject: [PATCH] gnu: xorg-server: Update to 1.20.11. * gnu/packages/xorg.scm (xorg-server): Update to 1.20.11. --- gnu/packages/xorg.scm | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gnu/packages/xorg.scm b/gnu/packages/xorg.scm index 97ff8ab92b..6b6fcbafa9 100644 --- a/gnu/packages/xorg.scm +++ b/gnu/packages/xorg.scm @@ -26,6 +26,7 @@ ;;; Copyright © 2020, 2021 Michael Rohleder <[email protected]> ;;; Copyright © 2020 Maxim Cournoyer <[email protected]> ;;; Copyright © 2020 Jean-Baptiste Note <[email protected]> +;;; Copyright © 2021 Nicolò Balzarotti <[email protected]> ;;; ;;; This file is part of GNU Guix. ;;; @@ -5302,7 +5303,7 @@ over Xlib, including: (define-public xorg-server (package (name "xorg-server") - (version "1.20.10") + (version "1.20.11") (source (origin (method url-fetch) @@ -5310,7 +5311,7 @@ over Xlib, including: "xorg-server-" version ".tar.bz2")) (sha256 (base32 - "16bwrf0ag41l7jbrllbix8z6avc5yimga7ihvq4ch3a5hb020x4p")) + "0jacqgin8kcyy8fyv0lhgb4if8g9hp60rm3ih3s1mgps7xp7jk4i")) (patches (list ;; See: -- 2.31.1
