a423d7d326
This fixes a format string vulnerabilty.
evdev_log_message() composes a format string consisting of a fixed
prefix (including the rendered device name) and the passed-in format
buffer. This format string is then passed with the arguments to the
actual log handler, which usually and eventually ends up being printf.
If the device name contains a printf-style format directive, these ended
up in the format string and thus get interpreted correctly, e.g. for a
device "Foo%sBar" the log message vs printf invocation ends up being:
evdev_log_message(device, "some message %s", "some argument");
printf("event9 - Foo%sBar: some message %s", "some argument");
This can enable an attacker to execute malicious code with the
privileges of the process using libinput.
To exploit this, an attacker needs to be able to create a kernel device
with a malicious name, e.g. through /dev/uinput or a Bluetooth device.
To fix this, convert any potential format directives in the device name
by duplicating percentages.
Pre-rendering the device to avoid the issue altogether would be nicer
but the current log level hooks do not easily allow for this. The device
name is the only user-controlled part of the format string.
A second potential issue is the sysname of the device which is also
sanitized.
This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from
Assured AB, and independently by Lukas Lamster.
Fixes #752
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||
|---|---|---|
| .gitlab/issue_templates | ||
| .gitlab-ci | ||
| completion/zsh | ||
| doc | ||
| include | ||
| quirks | ||
| src | ||
| test | ||
| tools | ||
| udev | ||
| .dir-locals.el | ||
| .editorconfig | ||
| .gitignore | ||
| .gitlab-ci.yml | ||
| .vimdir | ||
| CODING_STYLE.md | ||
| COPYING | ||
| meson.build | ||
| meson_options.txt | ||
| README.md | ||
libinput
libinput is a library that provides a full input stack for display servers and other applications that need to handle input devices provided by the kernel.
libinput provides device detection, event handling and abstraction to minimize the amount of custom input code the user of libinput needs to provide the common set of functionality that users expect. Input event processing includes scaling touch coordinates, generating relative pointer events from touchpads, pointer acceleration, etc.
User documentation
Documentation explaining features available in libinput is available here.
This includes the FAQ and the instructions on reporting bugs.
Source code
The source code of libinput can be found at: https://gitlab.freedesktop.org/libinput/libinput
For a list of current and past releases visit: https://www.freedesktop.org/wiki/Software/libinput/
Build instructions: https://wayland.freedesktop.org/libinput/doc/latest/building.html
Reporting Bugs
Bugs can be filed on freedesktop.org GitLab: https://gitlab.freedesktop.org/libinput/libinput/issues/
Where possible, please provide the libinput record output
of the input device and/or the event sequence in question.
See https://wayland.freedesktop.org/libinput/doc/latest/reporting-bugs.html for more info.
Documentation
- Developer API documentation: https://wayland.freedesktop.org/libinput/doc/latest/development.html
- High-level documentation about libinput's features: https://wayland.freedesktop.org/libinput/doc/latest/features.html
- Build instructions: https://wayland.freedesktop.org/libinput/doc/latest/building.html
- Documentation for previous versions of libinput: https://wayland.freedesktop.org/libinput/doc/
Examples of how to use libinput are the debugging tools in the libinput repository. Developers are encouraged to look at those tools for a real-world (yet simple) example on how to use libinput.
- A commandline debugging tool: https://gitlab.freedesktop.org/libinput/libinput/tree/main/tools/libinput-debug-events.c
- A GTK application that draws cursor/touch/tablet positions: https://gitlab.freedesktop.org/libinput/libinput/tree/main/tools/libinput-debug-gui.c
License
libinput is licensed under the MIT license.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: [...]
See the COPYING file for the full license information.
About
Documentation generated from git commit GIT_VERSION