{"id":103829,"date":"2022-04-20T21:36:45","date_gmt":"2022-04-20T19:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva"},"modified":"2022-04-20T21:36:45","modified_gmt":"2022-04-20T19:36:45","slug":"uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva","title":{"rendered":"libinput'i haavatavus, mis v\u00f5imaldab koodi k\u00e4ivitamist pahatahtliku seadme \u00fchendamise korral","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

libinput 1.20.1 raamatukogus, mis pakub \u00fchtset sisendi steki, v\u00f5imaldades sama sisendiseadmete s\u00fcndmuste t\u00f6\u00f6tlemist Waylandi ja X.Orgi keskkondades, on k\u00f5rvaldatud haavatavus (CVE-2022-1215), mis v\u00f5imaldab spetsiaalselt muudetud\/emuuleeritud sisendiseadme s\u00fcsteemi \u00fchendamisel oma koodi k\u00e4ivitamist. Probleem ilmneb X.Orgi ja Waylandi keskkondades ning seda saab \u00e4ra kasutada nii seadmete kohalikul \u00fchendamisel kui ka Bluetoothi-liidese seadmete manipulatsioonide kaudu. Kui X-server t\u00f6\u00f6tab root'i \u00f5igustega, v\u00f5imaldab haavatavus k\u00e4ivitada koodi suurenenud \u00f5igustega. <\/p>\n

Probleem tuleneb stringi vormindamise veast kode, mis vastutab seadme \u00fchendamise teabe logimise eest. T\u00e4psemalt, funktsioon evdev_log_msg muutis snprintf kutsumise abil algset logi salvestamise vormindamise stringi, millele lisati seadme nimi eelseisva m\u00e4rgina. Muudetud string anti seej\u00e4rel edasi funktsioonile log_msg_va, mis omakorda kasutas funktsiooni printf. Nii sattusid printf esimesele argumendile, millele rakendatakse vormindamisn\u00e4itajate anal\u00fc\u00fcsi, mitte kontrollitud v\u00e4lised andmed, ja r\u00fcndaja v\u00f5is algatada staki kahjustamise, korraldades seadme tagasi saatma nime, mis sisaldab stringi vormindamisn\u00e4itajaid (n\u00e4iteks \u00abEvil %s\u00bb).
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libinput 1.20.1, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0435\u043a \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0434\u043d\u0438 \u0438 \u0442\u0435 \u0436\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0432\u0432\u043e\u0434\u0430 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Wayland \u0438 X.Org, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-1215), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e\/\u044d\u043c\u0443\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 X.Org \u0438 Wayland, \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103829","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Libinputi haavand, mis viib pahatahtliku seadme \u00fchendusel koodi k\u00e4ivitamiseni | ProHoster","description":"Libinput 1.20.1 raamatukogus, mis pakub \u00fchetaolist sisendi jadapakkumist ja v\u00f5imaldab kasutada samu s\u00fcndmuste t\u00f6\u00f6tlemise vahendeid sisendseadmest s\u00f5ltumatult Waylandi ja X.Org p\u00f5histes keskkondades, on k\u00f5rvaldatud haavand (CVE-2022-1215), mis v\u00f5imaldab pahatahtlikul seadmel s\u00fcsteemiga \u00fchenduse loomisel oma koodi k\u00e4ivitada. Probleem ilmneb X.Org ja Waylandi p\u00f5histes keskkondades ning v\u00f5ib olla","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 libinput, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 libinput 1.20.1, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0442\u0435\u043a \u0432\u0432\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0434\u043d\u0438 \u0438 \u0442\u0435 \u0436\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u043e\u0431\u044b\u0442\u0438\u0439 \u043e\u0442 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0432\u0432\u043e\u0434\u0430 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Wayland \u0438 X.Org, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2022-1215), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e\/\u044d\u043c\u0443\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432\u0432\u043e\u0434\u0430. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 X.Org \u0438 Wayland, \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-libinput-privodyashhaya-k-vypolneniyu-koda-pri-podklyuchenii-vredonosnogo-ustrojstva","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-04-20T19:36:45+00:00","article:modified_time":"2022-04-20T19:36:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103829","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-25 10:32:03","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-04-20 19:37:13","updated":"2026-01-25 10:32:03"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=103829"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/103829\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=103829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=103829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=103829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}