mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-26 12:00:48 -09:00
a3f4bbe914
- CVE-2026-50292:
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-
group unescaped phys output can inject udev properties leading to
arbitrary root code execution
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-50292
- 8c15a01d16
- fc2262e1c1
- b2bde9504d
(cherry picked from commit 1cc0363191)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
96 lines
2.8 KiB
Diff
96 lines
2.8 KiB
Diff
From b2bde9504d42a5976d76e1f27c640dc561fbd99b Mon Sep 17 00:00:00 2001
|
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Date: Mon, 1 Jun 2026 10:48:24 +1000
|
|
Subject: [PATCH] libinput-device-group: sanitize phys before printing it
|
|
|
|
A malicious uinput device could set the phys value (via UI_SET_PHYS)
|
|
to contain a '\n'. When the value is printed as part of the device group
|
|
the udev rules will interpret it as separate property.
|
|
|
|
Depending on the property this can cause local privilege escalation.
|
|
|
|
Closes #1296
|
|
|
|
Found-by: Csome
|
|
(cherry picked from commit 76f0d8a7f57e2868882864b4611281f12f704b55)
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/libinput/libinput/-/merge_requests/1489>
|
|
Upstream: https://gitlab.freedesktop.org/libinput/libinput/-/commit/b2bde9504d42a5976d76e1f27c640dc561fbd99b
|
|
CVE: CVE-2026-50292
|
|
[thomas: backport]
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
udev/libinput-device-group.c | 13 +++++++------
|
|
1 file changed, 7 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/udev/libinput-device-group.c b/udev/libinput-device-group.c
|
|
index cdb38c0b..f9188406 100644
|
|
--- a/udev/libinput-device-group.c
|
|
+++ b/udev/libinput-device-group.c
|
|
@@ -109,7 +109,8 @@ wacom_handle_ekr(struct udev_device *dev
|
|
|
|
udev_list_entry_foreach(entry, udev_enumerate_get_list_entry(e)) {
|
|
struct udev_device *d;
|
|
- const char *path, *phys;
|
|
+ char *phys = NULL;
|
|
+ const char *path;
|
|
const char *pidstr, *vidstr;
|
|
int pid, vid, dist;
|
|
|
|
@@ -124,7 +125,7 @@ wacom_handle_ekr(struct udev_device *dev
|
|
|
|
vidstr = udev_device_get_property_value(d, "ID_VENDOR_ID");
|
|
pidstr = udev_device_get_property_value(d, "ID_MODEL_ID");
|
|
- phys = udev_device_get_sysattr_value(d, "phys");
|
|
+ phys = str_sanitize(udev_device_get_sysattr_value(d, "phys"));
|
|
|
|
if (vidstr && pidstr && phys &&
|
|
safe_atoi_base(vidstr, &vid, 16) &&
|
|
@@ -138,11 +139,13 @@ wacom_handle_ekr(struct udev_device *dev
|
|
best_dist = dist;
|
|
|
|
free(*phys_attr);
|
|
- *phys_attr = safe_strdup(phys);
|
|
+ *phys_attr = phys;
|
|
+ phys = NULL;
|
|
}
|
|
}
|
|
|
|
udev_device_unref(d);
|
|
+ free(phys);
|
|
}
|
|
|
|
udev_enumerate_unref(e);
|
|
@@ -154,8 +157,8 @@ int main(int argc, char **argv)
|
|
int rc = 1;
|
|
struct udev *udev = NULL;
|
|
struct udev_device *device = NULL;
|
|
- const char *syspath,
|
|
- *phys = NULL;
|
|
+ char *phys = NULL;
|
|
+ const char *syspath = NULL;
|
|
const char *product;
|
|
int bustype, vendor_id, product_id, version;
|
|
char group[1024];
|
|
@@ -179,8 +182,7 @@ int main(int argc, char **argv)
|
|
* bit and use the remainder as device group identifier */
|
|
while (device != NULL) {
|
|
struct udev_device *parent;
|
|
-
|
|
- phys = udev_device_get_sysattr_value(device, "phys");
|
|
+ phys = str_sanitize(udev_device_get_sysattr_value(device, "phys"));
|
|
if (phys)
|
|
break;
|
|
|
|
@@ -249,6 +251,8 @@ int main(int argc, char **argv)
|
|
|
|
printf("LIBINPUT_DEVICE_GROUP=%s\n", group);
|
|
|
|
+ free(phys);
|
|
+
|
|
rc = 0;
|
|
out:
|
|
if (device)
|
|
--
|
|
GitLab
|