{"id":103807,"date":"2022-04-17T21:36:41","date_gmt":"2022-04-17T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland"},"modified":"2022-04-17T21:36:41","modified_gmt":"2022-04-17T19:36:41","slug":"uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-swhkd-menedzhere-goryachih-klavish-dlya-wayland","title":{"rendered":"Vulnerabilities in swhkd, a hotkey manager for Wayland","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A series of vulnerabilities has been identified in swhkd (Simple Wayland HotKey Daemon), caused by improper handling of temporary files, command-line parameters, and Unix sockets. The program is written in Rust and processes hotkey presses in environments based on the Wayland protocol (file-configuration compatible analogous to the sxhkd process used in X11 environments). <\/p>\n
The package includes an unprivileged process swhks, which handles hotkey actions, and a background process swhkd, running with root privileges and interacting with input devices at the uinput API level. A Unix socket is used to facilitate communication between swhks and swhkd. Through Polkit rules, any local user is allowed to run the process \/usr\/bin\/swhkd with root privileges and pass arbitrary parameters to it. <\/p>\n
Identified vulnerabilities: <\/p>\n
\n
CVE-2022-27815 \u2014 saving the process PID to a file with a predictable name and in a directory writable by other users (\/tmp\/swhkd.pid). Any user can create the file \/tmp\/swhkd.pid and place the PID of an existing process into it, which will prevent swhkd from starting. In the absence of protection against creating symbolic links in \/tmp, this vulnerability can be exploited to create or overwrite files in any system directory (the PID is written to the file) or to determine the contents of any file on the system (swhkd outputs the entire contents of the PID file to stdout). It is noteworthy that in the released fix, the PID file was moved not to the \/run directory but to the \/etc directory (\/etc\/swhkd\/runtime\/swhkd_{uid}.pid), where it also does not belong.\n
CVE-2022-27814 \u2014 by manipulating the command line parameter \"-c\", which is used to specify the configuration file, it is possible to determine the existence of any file on the system. For example, to check \/root\/.somefile, one could run \"pkexec \/usr\/bin\/swhkd -d -c \/root\/.somefile\" and if the file is absent, the error \"\/root\/.somefile doesn't exist\" will be displayed. As with the first vulnerability, the fix raises questions \u2014 the solution reduces to using an external utility \"cat\" (\"Command::new('\/bin\/cat').arg(path).output()\" to read the configuration file.).\n
CVE-2022-27819 \u2014 this issue is also related to the use of the \"-c\" option, through which the configuration file is completely loaded and parsed without checking the size and type of the file. For example, to trigger a denial of service through memory exhaustion and generate parasitic input\/output, one could specify a block device when launching (\"pkexec \/usr\/bin\/swhkd -d -c \/dev\/sda\") or a character device that produces an infinite stream of data. The problem was resolved by dropping privileges before opening the file, but the fix was incomplete as only the user ID (UID) is dropped, while the group ID (GID) remains unchanged.\n
CVE-2022-27818 \u2014 a Unix socket is created using the file \/tmp\/swhkd.sock, which is created in a publicly writable directory, leading to similar issues as the first vulnerability (any user can create \/tmp\/swhkd.sock and generate or intercept key press events).\n
CVE-2022-27817 \u2014 Input events are accepted from all devices and in all sessions, meaning a user from another Wayland session or from the console can intercept key events when hotkeys are pressed by other users.\n
CVE-2022-27816 \u2014 The swhks process, like swhkd, uses a PID file \/tmp\/swhks.pid in a publicly writable directory \/tmp. The issue is similar to the first vulnerability, but it is less severe, as swhks runs under an unprivileged user. <\/ul>\n