francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
100 lines
3.0 KiB
Diff
100 lines
3.0 KiB
Diff
From b2bde9504d42a5976d76e1f27c640dc561fbd99b Mon Sep 17 00:00:00 2001
|
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Date: Mon, 1 Jun 2026 10:48:24 +1000
|
|
Subject: [PATCH] libinput-device-group: sanitize phys before printing it
|
|
|
|
Bug: https://gitlab.freedesktop.org/libinput/libinput/-/work_items/1296
|
|
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-50292
|
|
|
|
A malicious uinput device could set the phys value (via UI_SET_PHYS)
|
|
to contain a '\n'. When the value is printed as part of the device group
|
|
the udev rules will interpret it as separate property.
|
|
|
|
Depending on the property this can cause local privilege escalation.
|
|
|
|
Closes #1296
|
|
|
|
Found-by: Csome
|
|
(cherry picked from commit 76f0d8a7f57e2868882864b4611281f12f704b55)
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/libinput/libinput/-/merge_requests/1489>
|
|
|
|
CVE: CVE-2026-50292
|
|
Upstream-Status: Backport [https://gitlab.freedesktop.org/libinput/libinput/-/commit/b2bde9504d42a5976d76e1f27c640dc561fbd99b]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
udev/libinput-device-group.c | 18 +++++++++++-------
|
|
1 file changed, 11 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/udev/libinput-device-group.c b/udev/libinput-device-group.c
|
|
index 3da904e0..d0522685 100644
|
|
--- a/udev/libinput-device-group.c
|
|
+++ b/udev/libinput-device-group.c
|
|
@@ -109,7 +109,8 @@ wacom_handle_ekr(struct udev_device *device,
|
|
|
|
udev_list_entry_foreach(entry, udev_enumerate_get_list_entry(e)) {
|
|
struct udev_device *d;
|
|
- const char *path, *phys;
|
|
+ char *phys = NULL;
|
|
+ const char *path;
|
|
const char *pidstr, *vidstr;
|
|
int pid, vid, dist;
|
|
|
|
@@ -124,7 +125,7 @@ wacom_handle_ekr(struct udev_device *device,
|
|
|
|
vidstr = udev_device_get_property_value(d, "ID_VENDOR_ID");
|
|
pidstr = udev_device_get_property_value(d, "ID_MODEL_ID");
|
|
- phys = udev_device_get_sysattr_value(d, "phys");
|
|
+ phys = str_sanitize(udev_device_get_sysattr_value(d, "phys"));
|
|
|
|
if (vidstr && pidstr && phys &&
|
|
safe_atoi_base(vidstr, &vid, 16) &&
|
|
@@ -138,11 +139,13 @@ wacom_handle_ekr(struct udev_device *device,
|
|
best_dist = dist;
|
|
|
|
free(*phys_attr);
|
|
- *phys_attr = safe_strdup(phys);
|
|
+ *phys_attr = phys;
|
|
+ phys = NULL;
|
|
}
|
|
}
|
|
|
|
udev_device_unref(d);
|
|
+ free(phys);
|
|
}
|
|
|
|
udev_enumerate_unref(e);
|
|
@@ -154,8 +157,8 @@ int main(int argc, char **argv)
|
|
int rc = 1;
|
|
struct udev *udev = NULL;
|
|
struct udev_device *device = NULL;
|
|
- const char *syspath,
|
|
- *phys = NULL;
|
|
+ char *phys = NULL;
|
|
+ const char *syspath = NULL;
|
|
const char *product;
|
|
int bustype, vendor_id, product_id, version;
|
|
char group[1024];
|
|
@@ -179,8 +182,7 @@ int main(int argc, char **argv)
|
|
* bit and use the remainder as device group identifier */
|
|
while (device != NULL) {
|
|
struct udev_device *parent;
|
|
-
|
|
- phys = udev_device_get_sysattr_value(device, "phys");
|
|
+ phys = str_sanitize(udev_device_get_sysattr_value(device, "phys"));
|
|
if (phys)
|
|
break;
|
|
|
|
@@ -249,6 +251,8 @@ int main(int argc, char **argv)
|
|
|
|
printf("LIBINPUT_DEVICE_GROUP=%s\n", group);
|
|
|
|
+ free(phys);
|
|
+
|
|
rc = 0;
|
|
out:
|
|
if (device)
|
|
--
|
|
2.50.1
|
|
|