A series of vulnerabilities has been identified in swhkd (Simple Wayland HotKey Daemon), caused by improper handling of temporary files, command-line parameters, and Unix sockets. The program is written in Rust and processes hotkey presses in environments based on the Wayland protocol (file-configuration compatible analogous to the sxhkd process used in X11 environments).
The package includes an unprivileged process swhks, which handles hotkey actions, and a background process swhkd, running with root privileges and interacting with input devices at the uinput API level. A Unix socket is used to facilitate communication between swhks and swhkd. Through Polkit rules, any local user is allowed to run the process /usr/bin/swhkd with root privileges and pass arbitrary parameters to it.
Identified vulnerabilities:
- CVE-2022-27815 - The PID of the process is saved in a file with a predictable name in a directory writable by other users (/tmp/swhkd.pid). Any user can create the file /tmp/swhkd.pid and place the PID of an existing process in it, leading to the inability to start swhkd. In the absence of protection against creating symbolic links in /tmp, the vulnerability can be exploited to create or overwrite files in any system directory (the PID is written to the file) or to determine the contents of any file on the system (swhkd outputs the entire content of the PID file to stdout). Notably, in the released fix, the PID file has been moved not to the /run directory, but to the /etc directory (/etc/swhkd/runtime/swhkd_{uid}.pid), where it also does not belong.
- CVE-2022-27814 - By manipulating the command-line parameter "-c", used to specify the configuration file, it is possible to determine the existence of any file in the system. For example, to check /root/.somefile, you can run "pkexec /usr/bin/swhkd -d -c /root/.somefile" and if the file is missing, the error "/root/.somefile doesn’t exist" will be returned. As with the first vulnerability, the fix raises confusion — addressing the issue now involves launching an external utility "cat" to read the configuration file (‘Command::new(‘/bin/cat’).arg(path).output()’).
- CVE-2022-27819 — the issue is also related to the use of the option "-c", which causes the configuration file to be fully loaded and parsed without checking the size and type of the file. For example, to trigger a denial of service through memory exhaustion and create malicious I/O, a block device can be specified at startup ("pkexec /usr/bin/swhkd -d -c /dev/sda") or a character device that generates an infinite stream of data. The issue is resolved by dropping privileges before opening the file, but the fix was incomplete as it only resets the user ID (UID), while the group ID (GID) remains unchanged.
- CVE-2022-27818 — a Unix socket is created using the file /tmp/swhkd.sock, which is created in a publicly writable directory, leading to similar problems as the first vulnerability (any user can create /tmp/swhkd.sock and generate or intercept keystroke events).
- CVE-2022-27817 — input events are accepted from all devices and in all sessions, meaning that a user from another Wayland session or from the console can intercept events for hotkeys pressed by other users.
- CVE-2022-27816 — the swhks process, like swhkd, uses a PID file /tmp/swhks.pid in a publicly writable directory /tmp. The issue is similar to the first vulnerability, but it is not as dangerous since swhks runs under an unprivileged user.
Source: opennet.ru
