Re: [Mesa-dev] CVE-2019-19520: Local privilege escalation via xlock

2019-12-04 Thread Jonathan Gray
On Thu, Dec 05, 2019 at 01:59:50PM +1000, Dave Airlie wrote: > On Thu, 5 Dec 2019 at 13:42, Jonathan Gray wrote: > > > > Until very recently OpenBSD built xlockmore against Mesa. xlock is > > setgid auth. As described by Qualys in their advisory > > https://marc.info/?l=oss-security&m=1575492600

Re: [Mesa-dev] CVE-2019-19520: Local privilege escalation via xlock

2019-12-04 Thread Dave Airlie
On Thu, 5 Dec 2019 at 13:42, Jonathan Gray wrote: > > Until very recently OpenBSD built xlockmore against Mesa. xlock is > setgid auth. As described by Qualys in their advisory > https://marc.info/?l=oss-security&m=157549260013521&w=2 > "CVE-2019-19520: Local privilege escalation via xlock" > th

[Mesa-dev] CVE-2019-19520: Local privilege escalation via xlock

2019-12-04 Thread Jonathan Gray
Until very recently OpenBSD built xlockmore against Mesa. xlock is setgid auth. As described by Qualys in their advisory https://marc.info/?l=oss-security&m=157549260013521&w=2 "CVE-2019-19520: Local privilege escalation via xlock" the setuid check in the loader for LIBGL_DRIVERS_PATH does not ha