diff options
author | Peter Hutterer <peter.hutterer@who-t.net> | 2022-03-30 09:25:22 +1000 |
---|---|---|
committer | Peter Hutterer <peter.hutterer@who-t.net> | 2022-04-20 13:44:16 +1000 |
commit | 562157f2a56537f353ca49b194efeb770004ba63 (patch) | |
tree | 9b04114e6b14e31383528ecd7665ca5a7b61b2ed /test/litest.h | |
parent | 7f8113bb88f0c825119463efeb95c94c1c0b531d (diff) | |
download | libinput-562157f2a56537f353ca49b194efeb770004ba63.tar.gz |
evdev: strip the device name of format directives
This fixes a format string vulnerabilty.
evdev_log_message() composes a format string consisting of a fixed
prefix (including the rendered device name) and the passed-in format
buffer. This format string is then passed with the arguments to the
actual log handler, which usually and eventually ends up being printf.
If the device name contains a printf-style format directive, these ended
up in the format string and thus get interpreted correctly, e.g. for a
device "Foo%sBar" the log message vs printf invocation ends up being:
evdev_log_message(device, "some message %s", "some argument");
printf("event9 - Foo%sBar: some message %s", "some argument");
This can enable an attacker to execute malicious code with the
privileges of the process using libinput.
To exploit this, an attacker needs to be able to create a kernel device
with a malicious name, e.g. through /dev/uinput or a Bluetooth device.
To fix this, convert any potential format directives in the device name
by duplicating percentages.
Pre-rendering the device to avoid the issue altogether would be nicer
but the current log level hooks do not easily allow for this. The device
name is the only user-controlled part of the format string.
A second potential issue is the sysname of the device which is also
sanitized.
This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from
Assured AB, and independently by Lukas Lamster.
Fixes #752
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
(cherry picked from commit a423d7d3269dc32a87384f79e29bb5ac021c83d1)
Diffstat (limited to 'test/litest.h')
-rw-r--r-- | test/litest.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/test/litest.h b/test/litest.h index 53676521..925b6ca8 100644 --- a/test/litest.h +++ b/test/litest.h @@ -319,6 +319,7 @@ enum litest_device_type { LITEST_KEYBOARD_QUIRKED, LITEST_SYNAPTICS_PRESSUREPAD, LITEST_GENERIC_PRESSUREPAD, + LITEST_MOUSE_FORMAT_STRING, }; #define LITEST_DEVICELESS -2 |