A vulnerability has been identified in the libinput library, which provides a unified input stack for Wayland and X.Org Server (CVE not assigned), allowing code execution with root privileges through a local user connecting a virtual input device, emulated in user space via uinput or uhid. The issue has been fixed in releases 1.31.3 and 1.30.4.
The vulnerability exists in the udev handler of libinput-device-group and
is caused by inadequate escaping of special characters in the attributes obtained from devices and passed to the udev subsystem in the form of 'key=value'. By inserting a newline character ('\n') into the attribute, one can add their own udev rule, for example, by executing the uinput command UI_SET_PHYS('poc\n='). To execute arbitrary commands with root privileges, it is sufficient to insert a udev rule with the 'REMOVE_CMD' property, which triggers the specified command after the device is disconnected.
To exploit the vulnerability, an attacker must have access to the device /dev/uinput or /dev/uhid. Typically, access to uinput and uhid is limited to the root user, but some distributions come with udev rules that allow unprivileged users to utilize uinput. For instance, in Fedora, such rules are set up when installing the steam-devices, antimicrox, and kdeconnectd packages. A prototype of the exploit is available.
Source: opennet.ru
