Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Gentoo GLSA-202310-14 High: Libinput Format String Exploit

gentoo
Calendar Grey October 26, 2023
Dist Gentoo Esm H88
Uncover a critical security vulnerability related to format strings within libinput which impacts the Gentoo Linux distribution, potentially facilitating the execution of harmful code.
A vulnerability has been discovered in libinput where an attacker may run malicous code by exploiting a format string vulnerability.

Summary

An attacker may be able to run malicious code by exploiting a format string vulnerability. Please review the CVE identifier referenced below for details.

Topics%20covered

Topics Covered

security advisory high severity gentoo format string malicious code libinput input devices

Resolution

All libinput users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libinput-1.20.1"

References

[ 1 ] CVE-2022-1215 https://nvd.nist.gov/vuln/detail/CVE-2022-1215

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202310-14
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity: High
Title: libinput: format string vulnerability when using xf86-input-libinput
Date: October 26, 2023
Bugs: #839729
ID: 202310-14

Topics%20covered

Topics Covered

security advisory high severity gentoo format string malicious code libinput input devices

Synopsis

A vulnerability has been discovered in libinput where an attacker may run malicous code by exploiting a format string vulnerability.

Background

A library to handle input devices in Wayland and, via xf86-input- libinput, in X.org.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

Package Vulnerable Unaffected ----------------- ------------ ------------ dev-libs/libinput < 1.20.1 >= 1.20.1

Impact

When a device is detected by libinput, libinput logs several messages through log handlers set up by the callers. These log handlers usually eventually result in a printf call. Logging happens with the privileges of the caller, in the case of Xorg this may be root.
The device name ends up as part of the format string and a kernel device with printf-style format string placeholders in the device name can enable an attacker to run malicious code. An exploit is possible through any device where the attacker controls the device name, e.g. /dev/uinput or Bluetooth devices.

Workaround

There is no known workaround at this time.

Your message here