Critical Vulnerability in libinput: Local Attacker Can Exploit Input Device Names
Summary
USN-5382-2: libinput vulnerability. Affects libinput versions < 1.20.0-1ubuntu0.1. Fixed in 1.20.0-1ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libinput is a library that handles input devices in Linux environments, providing a unified interface for various input devices such as keyboards, mice, and touchpads. It is widely used in desktop environments to manage input events and ensure smooth user interactions. The vulnerability in libinput arises from improper handling of input devices with specially crafted names, which can lead to crashes or exposure of sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2022-1215, was discovered by Albin Eldstål-Ahrens and Lukas Lamster. It allows a local attacker with physical access to the system to exploit libinput's handling of input device names. By providing a specially crafted name for an input device, the attacker can cause libinput to crash, potentially leading to denial of service or the exposure of sensitive information. This issue affects versions of libinput prior to 1.20.0-1ubuntu0.1.
How To Fix
Minimum fixed version
1.20.0-1ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libinputTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit physical access to the system to prevent potential exploitation by unauthorized individuals. Additionally, monitoring input devices for unusual names can help mitigate the risk until the package is updated.
Conclusion
The vulnerability in libinput poses a significant risk to systems with physical access. It is crucial for users to update to the patched version to mitigate potential attacks. By following the recommended steps and utilizing tools like Vulert, users can ensure their systems remain secure against this and other vulnerabilities.
See every vulnerability recorded for libinput →
FAQ
libinput is a library that manages input devices in Linux environments, providing a consistent interface for handling input events from various devices.
The vulnerability allows a local attacker to exploit specially crafted input device names, potentially causing crashes or exposing sensitive information.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Update libinput to the patched version 1.20.0-1ubuntu0.1 using the command: sudo apt update && sudo apt upgrade libinput.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for libinput.
