{"id":103829,"date":"2022-04-20T21:36:45","date_gmt":"2022-04-20T19:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva"},"modified":"2022-04-20T21:36:45","modified_gmt":"2022-04-20T19:36:45","slug":"uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva","title":{"rendered":"A vulnerability in libinput leads to code execution when a malicious device is connected.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In the libinput library 1.20.1, which provides a unified input stack allowing the same event handling tools for input devices in Wayland and X.Org environments, a vulnerability (CVE-2022-1215) has been fixed. This vulnerability allows for the execution of arbitrary code when connecting a specially modified\/emulated input device to the system. The issue manifests in both X.Org and Wayland environments and can be exploited through local device connections as well as manipulation of Bluetooth interface devices. If the X server runs with root privileges, the vulnerability could lead to the execution of code with elevated privileges. <\/p>\n
The issue was caused by a string formatting error in the code responsible for logging device connection information. Specifically, the function evdev_log_msg used snprintf to modify the original formatting string for the log entry, adding the device name as a prefix. The modified string was then passed to the log_msg_va function, which in turn used printf. As a result, unchecked external data ended up in the first argument of printf, where formatting characters were parsed, allowing an attacker to exploit the stack by providing a device name that contained formatting string characters (for example, \"Evil %s\"). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"