In the libinput library 1.20.1, which provides a unified input stack allowing the same event handling tools for input devices in Wayland and X.Org environments, a vulnerability (CVE-2022-1215) has been fixed. This vulnerability allows for the execution of arbitrary code when connecting a specially modified/emulated input device to the system. The issue manifests in both X.Org and Wayland environments and can be exploited through local device connections as well as manipulation of Bluetooth interface devices. If the X server runs with root privileges, the vulnerability could lead to the execution of code with elevated privileges.
The problem is caused by a string formatting error in the code responsible for logging device connection information. Specifically, the evdev_log_msg function, using snprintf, alters the original formatting string for the log entry by adding the device name as a prefix. This modified string is then passed to the log_msg_va function, which, in turn, utilizes the printf function. As a result, unchecked external data appears in the first argument of printf, where formatting characters are parsed, allowing an attacker to initiate a stack corruption by returning a device name containing formatting characters (e.g., 'Evil %s').
Source: opennet.ru
