[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2022-1215 libinput format string vulnerability
From:       Peter Hutterer <peter.hutterer () redhat ! com>
Date:       2022-04-20 5:58:20
Message-ID: 86c70de9-3adb-a18c-23aa-0110d83dbdc2 () redhat ! com
[Download RAW message or body]

Title: Format string vulnerability in libinput
Component: libinput, affecting all Wayland compositors and X.Org when 
using xf86-input-libinput
Report URL: https://gitlab.freedesktop.org/libinput/libinput/-/issues/752
Reporter: Albin Eldstål-Ahrens and Lukas Lamster
CVSS: 7.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
Disclosure date: Embargo cancelled due to an independent public bug filed

When a device is detected by libinput, libinput logs several messages 
through log handlers set up by the callers. These log handlers usually 
eventually result in a printf call. Logging happens with the privileges 
of the caller, in the case of Xorg this may be root.

The device name ends up as part of the format string and a kernel device 
with printf-style format string placeholders in the device name can 
enable an attacker to run malicious code. An exploit is possible through 
any device where the attacker controls the device name, e.g. /dev/uinput 
or Bluetooth devices.

All versions of libinput since 1.10 (released Feb 2018) are affected.

The upstream patch is available as commit
   2a8b8fde90d63d48ce09ddae44142674bbca1c28

libinput releases that include these patches are:
- 1.20.1
- 1.19.4
- 1.18.2
Releases of versions 1.17.x and earlier are not planned at this stage.

Many thanks to Albin Eldstål-Ahrens and Benjamin Svensson from Assured 
AB for their discovery and responsible reporting of this issue.

This issue was independently discovered by Lukas Lamster. Many thanks 
for their discovery and responsible reporting.

[prev in list] [next in list] [prev in thread] [next in thread]