CVE-2022-1215: High severity Freedesktop Libinput vulnerability
A format string vulnerability was found in libinput
Other sources
When a device is detected by libinput, libinput logs several messages through log handlers set up by the callers. These log handlers usually eventually result in a printf call. Logging happens with the privileges of the caller, in the case of Xorg this may be root.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libinputto a version that resolves this vulnerability.Fixed in 1.22.1-1+deb12u1Fixed in 1.28.1-1+deb13u1Fixed in 1.31.3-1 - Upgrade
Upgrade
alpine/libinputto a version that resolves this vulnerability.Fixed in 1.19.4-r0 - Upgrade
Upgrade
alpine/libinputto a version that resolves this vulnerability.Fixed in 1.20.1-r0 - Upgrade
Upgrade
debian/libinputto a version that resolves this vulnerability.Fixed in 1.20.1-1 - Upgrade
Upgrade
redhat/libinputto a version that resolves this vulnerability.Fixed in 1.20.1 - Upgrade
Upgrade
redhat/libinputto a version that resolves this vulnerability.Fixed in 1.18.4 - Upgrade
Upgrade
redhat/libinputto a version that resolves this vulnerability.Fixed in 1.18.2
Event History
Frequently Asked Questions
What is CVE-2022-1215?
CVE-2022-1215 is a format string vulnerability found in libinput.
What software is affected by CVE-2022-1215?
The affected software is Freedesktop Libinput versions 1.10.0 to 1.18.2, 1.19.0 to 1.19.4, and 1.20.0.
What is the severity of CVE-2022-1215?
CVE-2022-1215 has a severity rating of 7.8 (High).
How can I fix CVE-2022-1215?
To fix CVE-2022-1215, it is recommended to update to a patched version of Freedesktop Libinput.
Where can I find more information about CVE-2022-1215?
You can find more information about CVE-2022-1215 at the following sources: [seclists.org](https://seclists.org/oss-sec/2022/q2/47), [security.gentoo.org](https://security.gentoo.org/glsa/202310-14).