import libinput-1.16.3-3.el8_6
This commit is contained in:
CentOS Sources
Stepan Oksanichenko
parent
c07416393f
commit
dd316dcc14
@ -0,0 +1,358 @@
|
|||||||
|
From d16e13645c11a4acdd6ed5f0bcbd486fcc2324f5 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
||||||
|
Date: Wed, 30 Mar 2022 09:25:22 +1000
|
||||||
|
Subject: [PATCH] evdev: strip the device name of format directives
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
|
This fixes a format string vulnerabilty.
|
||||||
|
|
||||||
|
evdev_log_message() composes a format string consisting of a fixed
|
||||||
|
prefix (including the rendered device name) and the passed-in format
|
||||||
|
buffer. This format string is then passed with the arguments to the
|
||||||
|
actual log handler, which usually and eventually ends up being printf.
|
||||||
|
|
||||||
|
If the device name contains a printf-style format directive, these ended
|
||||||
|
up in the format string and thus get interpreted correctly, e.g. for a
|
||||||
|
device "Foo%sBar" the log message vs printf invocation ends up being:
|
||||||
|
evdev_log_message(device, "some message %s", "some argument");
|
||||||
|
printf("event9 - Foo%sBar: some message %s", "some argument");
|
||||||
|
|
||||||
|
This can enable an attacker to execute malicious code with the
|
||||||
|
privileges of the process using libinput.
|
||||||
|
|
||||||
|
To exploit this, an attacker needs to be able to create a kernel device
|
||||||
|
with a malicious name, e.g. through /dev/uinput or a Bluetooth device.
|
||||||
|
|
||||||
|
To fix this, convert any potential format directives in the device name
|
||||||
|
by duplicating percentages.
|
||||||
|
|
||||||
|
Pre-rendering the device to avoid the issue altogether would be nicer
|
||||||
|
but the current log level hooks do not easily allow for this. The device
|
||||||
|
name is the only user-controlled part of the format string.
|
||||||
|
|
||||||
|
A second potential issue is the sysname of the device which is also
|
||||||
|
sanitized.
|
||||||
|
|
||||||
|
This issue was found by Albin Eldstål-Ahrens and Benjamin Svensson from
|
||||||
|
Assured AB, and independently by Lukas Lamster.
|
||||||
|
|
||||||
|
Fixes #752
|
||||||
|
|
||||||
|
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
|
||||||
|
(cherry picked from commit a423d7d3269dc32a87384f79e29bb5ac021c83d1)
|
||||||
|
---
|
||||||
|
meson.build | 1 +
|
||||||
|
src/evdev.c | 31 +++++++++++------
|
||||||
|
src/evdev.h | 6 ++--
|
||||||
|
src/util-strings.h | 30 ++++++++++++++++
|
||||||
|
test/litest-device-format-string.c | 56 ++++++++++++++++++++++++++++++
|
||||||
|
test/litest.h | 1 +
|
||||||
|
test/test-utils.c | 26 ++++++++++++++
|
||||||
|
7 files changed, 139 insertions(+), 12 deletions(-)
|
||||||
|
create mode 100644 test/litest-device-format-string.c
|
||||||
|
|
||||||
|
diff --git a/meson.build b/meson.build
|
||||||
|
index 040e3f1f..05e405fe 100644
|
||||||
|
--- a/meson.build
|
||||||
|
+++ b/meson.build
|
||||||
|
@@ -776,6 +776,7 @@ if get_option('tests')
|
||||||
|
'test/litest-device-dell-canvas-totem-touch.c',
|
||||||
|
'test/litest-device-elantech-touchpad.c',
|
||||||
|
'test/litest-device-elan-tablet.c',
|
||||||
|
+ 'test/litest-device-format-string.c',
|
||||||
|
'test/litest-device-generic-singletouch.c',
|
||||||
|
'test/litest-device-gpio-keys.c',
|
||||||
|
'test/litest-device-huion-pentablet.c',
|
||||||
|
diff --git a/src/evdev.c b/src/evdev.c
|
||||||
|
index 44d01711..3f674ba2 100644
|
||||||
|
--- a/src/evdev.c
|
||||||
|
+++ b/src/evdev.c
|
||||||
|
@@ -2218,19 +2218,19 @@ evdev_device_create(struct libinput_seat *seat,
|
||||||
|
struct libinput *libinput = seat->libinput;
|
||||||
|
struct evdev_device *device = NULL;
|
||||||
|
int rc;
|
||||||
|
- int fd;
|
||||||
|
+ int fd = -1;
|
||||||
|
int unhandled_device = 0;
|
||||||
|
const char *devnode = udev_device_get_devnode(udev_device);
|
||||||
|
- const char *sysname = udev_device_get_sysname(udev_device);
|
||||||
|
+ char *sysname = str_sanitize(udev_device_get_sysname(udev_device));
|
||||||
|
|
||||||
|
if (!devnode) {
|
||||||
|
log_info(libinput, "%s: no device node associated\n", sysname);
|
||||||
|
- return NULL;
|
||||||
|
+ goto err;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (udev_device_should_be_ignored(udev_device)) {
|
||||||
|
log_debug(libinput, "%s: device is ignored\n", sysname);
|
||||||
|
- return NULL;
|
||||||
|
+ goto err;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* Use non-blocking mode so that we can loop on read on
|
||||||
|
@@ -2244,13 +2244,15 @@ evdev_device_create(struct libinput_seat *seat,
|
||||||
|
sysname,
|
||||||
|
devnode,
|
||||||
|
strerror(-fd));
|
||||||
|
- return NULL;
|
||||||
|
+ goto err;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!evdev_device_have_same_syspath(udev_device, fd))
|
||||||
|
goto err;
|
||||||
|
|
||||||
|
device = zalloc(sizeof *device);
|
||||||
|
+ device->sysname = sysname;
|
||||||
|
+ sysname = NULL;
|
||||||
|
|
||||||
|
libinput_device_init(&device->base, seat);
|
||||||
|
libinput_seat_ref(seat);
|
||||||
|
@@ -2273,6 +2275,9 @@ evdev_device_create(struct libinput_seat *seat,
|
||||||
|
device->dispatch = NULL;
|
||||||
|
device->fd = fd;
|
||||||
|
device->devname = libevdev_get_name(device->evdev);
|
||||||
|
+ /* the log_prefix_name is used as part of a printf format string and
|
||||||
|
+ * must not contain % directives, see evdev_log_msg */
|
||||||
|
+ device->log_prefix_name = str_sanitize(device->devname);
|
||||||
|
device->scroll.threshold = 5.0; /* Default may be overridden */
|
||||||
|
device->scroll.direction_lock_threshold = 5.0; /* Default may be overridden */
|
||||||
|
device->scroll.direction = 0;
|
||||||
|
@@ -2313,12 +2318,16 @@ evdev_device_create(struct libinput_seat *seat,
|
||||||
|
return device;
|
||||||
|
|
||||||
|
err:
|
||||||
|
- close_restricted(libinput, fd);
|
||||||
|
- if (device) {
|
||||||
|
- unhandled_device = device->seat_caps == 0;
|
||||||
|
- evdev_device_destroy(device);
|
||||||
|
+ if (fd >= 0) {
|
||||||
|
+ close_restricted(libinput, fd);
|
||||||
|
+ if (device) {
|
||||||
|
+ unhandled_device = device->seat_caps == 0;
|
||||||
|
+ evdev_device_destroy(device);
|
||||||
|
+ }
|
||||||
|
}
|
||||||
|
|
||||||
|
+ free(sysname);
|
||||||
|
+
|
||||||
|
return unhandled_device ? EVDEV_UNHANDLED_DEVICE : NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -2331,7 +2340,7 @@ evdev_device_get_output(struct evdev_device *device)
|
||||||
|
const char *
|
||||||
|
evdev_device_get_sysname(struct evdev_device *device)
|
||||||
|
{
|
||||||
|
- return udev_device_get_sysname(device->udev_device);
|
||||||
|
+ return device->sysname;
|
||||||
|
}
|
||||||
|
|
||||||
|
const char *
|
||||||
|
@@ -2909,6 +2918,8 @@ evdev_device_destroy(struct evdev_device *device)
|
||||||
|
if (device->base.group)
|
||||||
|
libinput_device_group_unref(device->base.group);
|
||||||
|
|
||||||
|
+ free(device->log_prefix_name);
|
||||||
|
+ free(device->sysname);
|
||||||
|
free(device->output_name);
|
||||||
|
filter_destroy(device->pointer.filter);
|
||||||
|
libinput_timer_destroy(&device->scroll.timer);
|
||||||
|
diff --git a/src/evdev.h b/src/evdev.h
|
||||||
|
index b0b1b8c6..785ba9ae 100644
|
||||||
|
--- a/src/evdev.h
|
||||||
|
+++ b/src/evdev.h
|
||||||
|
@@ -169,6 +169,8 @@ struct evdev_device {
|
||||||
|
struct udev_device *udev_device;
|
||||||
|
char *output_name;
|
||||||
|
const char *devname;
|
||||||
|
+ char *log_prefix_name;
|
||||||
|
+ char *sysname;
|
||||||
|
bool was_removed;
|
||||||
|
int fd;
|
||||||
|
enum evdev_device_seat_capability seat_caps;
|
||||||
|
@@ -770,7 +772,7 @@ evdev_log_msg(struct evdev_device *device,
|
||||||
|
sizeof(buf),
|
||||||
|
"%-7s - %s%s%s",
|
||||||
|
evdev_device_get_sysname(device),
|
||||||
|
- (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->devname : "",
|
||||||
|
+ (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->log_prefix_name : "",
|
||||||
|
(priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? ": " : "",
|
||||||
|
format);
|
||||||
|
|
||||||
|
@@ -805,7 +807,7 @@ evdev_log_msg_ratelimit(struct evdev_device *device,
|
||||||
|
sizeof(buf),
|
||||||
|
"%-7s - %s%s%s",
|
||||||
|
evdev_device_get_sysname(device),
|
||||||
|
- (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->devname : "",
|
||||||
|
+ (priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? device->log_prefix_name : "",
|
||||||
|
(priority > LIBINPUT_LOG_PRIORITY_DEBUG) ? ": " : "",
|
||||||
|
format);
|
||||||
|
|
||||||
|
diff --git a/src/util-strings.h b/src/util-strings.h
|
||||||
|
index 80e88aeb..5a0711d0 100644
|
||||||
|
--- a/src/util-strings.h
|
||||||
|
+++ b/src/util-strings.h
|
||||||
|
@@ -43,6 +43,8 @@
|
||||||
|
#include <xlocale.h>
|
||||||
|
#endif
|
||||||
|
|
||||||
|
+#include "util-macros.h"
|
||||||
|
+
|
||||||
|
#define streq(s1, s2) (strcmp((s1), (s2)) == 0)
|
||||||
|
#define strneq(s1, s2, n) (strncmp((s1), (s2), (n)) == 0)
|
||||||
|
|
||||||
|
@@ -376,3 +378,31 @@ strstartswith(const char *str, const char *prefix)
|
||||||
|
|
||||||
|
return prefixlen > 0 ? strneq(str, prefix, strlen(prefix)) : false;
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+/**
|
||||||
|
+ * Return a copy of str with all % converted to %% to make the string
|
||||||
|
+ * acceptable as printf format.
|
||||||
|
+ */
|
||||||
|
+static inline char *
|
||||||
|
+str_sanitize(const char *str)
|
||||||
|
+{
|
||||||
|
+ if (!str)
|
||||||
|
+ return NULL;
|
||||||
|
+
|
||||||
|
+ if (!strchr(str, '%'))
|
||||||
|
+ return strdup(str);
|
||||||
|
+
|
||||||
|
+ size_t slen = min(strlen(str), 512);
|
||||||
|
+ char *sanitized = zalloc(2 * slen + 1);
|
||||||
|
+ const char *src = str;
|
||||||
|
+ char *dst = sanitized;
|
||||||
|
+
|
||||||
|
+ for (size_t i = 0; i < slen; i++) {
|
||||||
|
+ if (*src == '%')
|
||||||
|
+ *dst++ = '%';
|
||||||
|
+ *dst++ = *src++;
|
||||||
|
+ }
|
||||||
|
+ *dst = '\0';
|
||||||
|
+
|
||||||
|
+ return sanitized;
|
||||||
|
+}
|
||||||
|
diff --git a/test/litest-device-format-string.c b/test/litest-device-format-string.c
|
||||||
|
new file mode 100644
|
||||||
|
index 00000000..aed15db4
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/test/litest-device-format-string.c
|
||||||
|
@@ -0,0 +1,56 @@
|
||||||
|
+
|
||||||
|
+/*
|
||||||
|
+ * Copyright © 2013 Red Hat, Inc.
|
||||||
|
+ *
|
||||||
|
+ * Permission is hereby granted, free of charge, to any person obtaining a
|
||||||
|
+ * copy of this software and associated documentation files (the "Software"),
|
||||||
|
+ * to deal in the Software without restriction, including without limitation
|
||||||
|
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
||||||
|
+ * and/or sell copies of the Software, and to permit persons to whom the
|
||||||
|
+ * Software is furnished to do so, subject to the following conditions:
|
||||||
|
+ *
|
||||||
|
+ * The above copyright notice and this permission notice (including the next
|
||||||
|
+ * paragraph) shall be included in all copies or substantial portions of the
|
||||||
|
+ * Software.
|
||||||
|
+ *
|
||||||
|
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
|
||||||
|
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
||||||
|
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
||||||
|
+ * DEALINGS IN THE SOFTWARE.
|
||||||
|
+ */
|
||||||
|
+
|
||||||
|
+#include "config.h"
|
||||||
|
+
|
||||||
|
+#include "litest.h"
|
||||||
|
+#include "litest-int.h"
|
||||||
|
+
|
||||||
|
+static struct input_id input_id = {
|
||||||
|
+ .bustype = 0x3,
|
||||||
|
+ .vendor = 0x0123,
|
||||||
|
+ .product = 0x0456,
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+static int events[] = {
|
||||||
|
+ EV_KEY, BTN_LEFT,
|
||||||
|
+ EV_KEY, BTN_RIGHT,
|
||||||
|
+ EV_KEY, BTN_MIDDLE,
|
||||||
|
+ EV_REL, REL_X,
|
||||||
|
+ EV_REL, REL_Y,
|
||||||
|
+ EV_REL, REL_WHEEL,
|
||||||
|
+ EV_REL, REL_WHEEL_HI_RES,
|
||||||
|
+ -1 , -1,
|
||||||
|
+};
|
||||||
|
+
|
||||||
|
+TEST_DEVICE("mouse-format-string",
|
||||||
|
+ .type = LITEST_MOUSE_FORMAT_STRING,
|
||||||
|
+ .features = LITEST_RELATIVE | LITEST_BUTTON | LITEST_WHEEL,
|
||||||
|
+ .interface = NULL,
|
||||||
|
+
|
||||||
|
+ .name = "Evil %s %d %x Mouse %p %",
|
||||||
|
+ .id = &input_id,
|
||||||
|
+ .absinfo = NULL,
|
||||||
|
+ .events = events,
|
||||||
|
+)
|
||||||
|
diff --git a/test/litest.h b/test/litest.h
|
||||||
|
index 25dc9eed..8b6d1ea3 100644
|
||||||
|
--- a/test/litest.h
|
||||||
|
+++ b/test/litest.h
|
||||||
|
@@ -307,6 +307,7 @@ enum litest_device_type {
|
||||||
|
LITEST_KEYBOARD_LOGITECH_MEDIA_KEYBOARD_ELITE,
|
||||||
|
LITEST_SONY_VAIO_KEYS,
|
||||||
|
LITEST_KEYBOARD_QUIRKED,
|
||||||
|
+ LITEST_MOUSE_FORMAT_STRING,
|
||||||
|
};
|
||||||
|
|
||||||
|
#define LITEST_DEVICELESS -2
|
||||||
|
diff --git a/test/test-utils.c b/test/test-utils.c
|
||||||
|
index 5955f56e..aa239092 100644
|
||||||
|
--- a/test/test-utils.c
|
||||||
|
+++ b/test/test-utils.c
|
||||||
|
@@ -1196,6 +1196,31 @@ START_TEST(strstartswith_test)
|
||||||
|
}
|
||||||
|
END_TEST
|
||||||
|
|
||||||
|
+START_TEST(strsanitize_test)
|
||||||
|
+{
|
||||||
|
+ struct strsanitize_test {
|
||||||
|
+ const char *string;
|
||||||
|
+ const char *expected;
|
||||||
|
+ } tests[] = {
|
||||||
|
+ { "foobar", "foobar" },
|
||||||
|
+ { "", "" },
|
||||||
|
+ { "%", "%%" },
|
||||||
|
+ { "%%%%", "%%%%%%%%" },
|
||||||
|
+ { "x %s", "x %%s" },
|
||||||
|
+ { "x %", "x %%" },
|
||||||
|
+ { "%sx", "%%sx" },
|
||||||
|
+ { "%s%s", "%%s%%s" },
|
||||||
|
+ { NULL, NULL },
|
||||||
|
+ };
|
||||||
|
+
|
||||||
|
+ for (struct strsanitize_test *t = tests; t->string; t++) {
|
||||||
|
+ char *sanitized = str_sanitize(t->string);
|
||||||
|
+ ck_assert_str_eq(sanitized, t->expected);
|
||||||
|
+ free(sanitized);
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
+END_TEST
|
||||||
|
+
|
||||||
|
START_TEST(list_test_insert)
|
||||||
|
{
|
||||||
|
struct list_test {
|
||||||
|
@@ -1305,6 +1330,7 @@ litest_utils_suite(void)
|
||||||
|
tcase_add_test(tc, strstrip_test);
|
||||||
|
tcase_add_test(tc, strendswith_test);
|
||||||
|
tcase_add_test(tc, strstartswith_test);
|
||||||
|
+ tcase_add_test(tc, strsanitize_test);
|
||||||
|
tcase_add_test(tc, time_conversion);
|
||||||
|
tcase_add_test(tc, human_time);
|
||||||
|
|
||||||
|
--
|
||||||
|
2.36.0
|
||||||
|
|
||||||
@ -5,7 +5,7 @@
|
|||||||
|
|
||||||
Name: libinput
|
Name: libinput
|
||||||
Version: 1.16.3
|
Version: 1.16.3
|
||||||
Release: 2%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
|
Release: 3%{?gitdate:.%{gitdate}git%{gitversion}}%{?dist}
|
||||||
Summary: Input device library
|
Summary: Input device library
|
||||||
|
|
||||||
License: MIT
|
License: MIT
|
||||||
@ -32,6 +32,9 @@ Patch008: 0004-quirks-add-AttrInputPropEnable-and-Disable.patch
|
|||||||
Patch009: 0005-tools-print-the-AttrEventCodeEnable-and-AttrInputPro.patch
|
Patch009: 0005-tools-print-the-AttrEventCodeEnable-and-AttrInputPro.patch
|
||||||
Patch010: 0006-quirks-add-quirk-for-Dell-Precision-7550-7750-touchp.patch
|
Patch010: 0006-quirks-add-quirk-for-Dell-Precision-7550-7750-touchp.patch
|
||||||
|
|
||||||
|
# CVE-2022-1215: format string vulnerability (#2076815)
|
||||||
|
Patch011: 0001-evdev-strip-the-device-name-of-format-directives.patch
|
||||||
|
|
||||||
BuildRequires: git-core
|
BuildRequires: git-core
|
||||||
BuildRequires: gcc gcc-c++
|
BuildRequires: gcc gcc-c++
|
||||||
BuildRequires: meson
|
BuildRequires: meson
|
||||||
@ -159,6 +162,10 @@ rm $RPM_BUILD_ROOT/%{_mandir}/man1/libinput-measure-touchpad-size.1*
|
|||||||
%{_mandir}/man1/libinput-test-suite.1*
|
%{_mandir}/man1/libinput-test-suite.1*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Thu Apr 28 2022 Peter Hutterer <peter.hutterer@redhat.com> - 1.16.3-3
|
||||||
|
- Fix a format string vulnerability in the device name logging (#2076815)
|
||||||
|
CVE-2022-1215
|
||||||
|
|
||||||
* Tue May 25 2021 Peter Hutterer <peter.hutterer@redhat.com> 1.16.3-2
|
* Tue May 25 2021 Peter Hutterer <peter.hutterer@redhat.com> 1.16.3-2
|
||||||
- Add support for AddrInputPropDisable (#1951885)
|
- Add support for AddrInputPropDisable (#1951885)
|
||||||
|
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user