High-Severity Libinput Format String Vulnerability in Gentoo Systems
Summary
An attacker may be able to run malicious code by exploiting a format
string vulnerability. Please review the CVE identifier referenced below
for details.
Resolution
All libinput users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-libs/libinput-1.20.1"
References
[ 1 ] CVE-2022-1215
https://nvd.nist.gov/vuln/detail/CVE-2022-1215
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202310-14
Concerns
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
Background
A library to handle input devices in Wayland and, via xf86-input-
libinput, in X.org.
Affected Packages
Package Vulnerable Unaffected
----------------- ------------ ------------
dev-libs/libinput < 1.20.1 >= 1.20.1
Impact
When a device is detected by libinput, libinput logs several messages
through log handlers set up by the callers. These log handlers usually
eventually result in a printf call. Logging happens with the privileges
of the caller, in the case of Xorg this may be root.
The device name ends up as part of the format string and a kernel device
with printf-style format string placeholders in the device name can
enable an attacker to run malicious code. An exploit is possible through
any device where the attacker controls the device name, e.g. /dev/uinput
or Bluetooth devices.
Workaround
There is no known workaround at this time.
