{"id":181898,"date":"2026-06-04T14:48:17","date_gmt":"2026-06-04T12:48:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-libinput-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme"},"modified":"2026-06-04T14:48:17","modified_gmt":"2026-06-04T12:48:17","slug":"uyazvimost-v-libinput-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-libinput-pozvolyayushhaya-povysit-svoi-privilegii-v-sisteme","title":{"rendered":"A vulnerability in libinput, allowing privilege escalation in the system.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A vulnerability has been identified in the libinput library, which provides a unified input stack for Wayland and X.Org Server (CVE not assigned), allowing code execution with root privileges through a local user connecting a virtual input device, emulated in user space via uinput or uhid. The issue has been fixed in releases 1.31.3 and 1.30.4.<\/p>\n
The vulnerability exists in the udev handler of libinput-device-group and \nThis issue is caused by the lack of proper escaping of special characters in attributes received from devices and transmitted to the udev subsystem in the form of \"key=value\". By substituting the newline character (\"\n\") in the attribute, it's possible to add your own udev rule, for example, by executing the uinput command UI_SET_PHYS(\"poc\n=\"). To execute arbitrary commands with root privileges, you can similarly substitute a udev rule with the property \"REMOVE_CMD\", which runs the specified command after the device is disconnected.<\/p>\n
To exploit the vulnerability, an attacker must have access to the device \/dev\/uinput or \/dev\/uhid. Typically, access to uinput and uhid is limited to the root user, but some distributions come with udev rules that allow unprivileged users to utilize uinput. For instance, in Fedora, such rules are set up when installing the steam-devices, antimicrox, and kdeconnectd packages. A prototype of the exploit is available. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"