PT-2022-2364 · Libinput+11 · Libinput+11

Albin Eldstål-Ahrens + 1 · Published 2022-04-20 · Updated 2024-04-04 · CVE-2022-1215

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libinput version 1.20.1

Description A format string vulnerability was found in libinput, related to the use of uncontrolled format strings in the evdev log msg function. This vulnerability can be exploited to execute arbitrary code with elevated privileges, particularly when the X-server is run with root privileges. The issue affects environments based on X.Org and Wayland and can be exploited through local device connections or manipulations with Bluetooth devices.

Recommendations For libinput version 1.20.1, consider updating to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the evdev log msg function to minimize the risk of exploitation. Avoid using the evdev log msg function in the affected API endpoints until the issue is resolved.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

ALSA-2022:5257

ALT-PU-2021-4844

ALT-PU-2021-4845

ALT-PU-2022-1732

ALT-PU-2022-1738

ALT-PU-2022-1752

ALT-PU-2022-3182

ALT-PU-2022-7644

AZL-9861

BDU:2022-02695

CESA-2022_5331

CVE-2022-1215

MGASA-2022-0150

OESA-2022-1709

OPENSUSE-SU-2022_1305-1

OPENSUSE-SU-2024:12023-1

RHSA-2022:5257

RHSA-2022:5331

RHSA-2022_5257

RHSA-2022_5331

RLSA-2022:5257

RLSA-2022:5331

SUSE-SU-2022:1305-1

SUSE-SU-2022_1305-1

USN-5382-1

USN-5382-2

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

Libinput

References · 60

• https://bdu.fstec.ru/vul/2022-02695 · Security Note
• https://ubuntu.com/security/CVE-2022-1215 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1305-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5382-2 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-5331.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-9861 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2022-0150 · Vendor Advisory
• https://security.gentoo.org/glsa/202310-14 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1215 · Security Note
• https://osv.dev/vulnerability/USN-5382-2 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1709 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0150.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2022-1215 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-1215 · Vendor Advisory