REDHAT-BUG-2453840: Medium severity freedesktop.org libinput vulnerability
An attacker that can deploy a lua file {/usr/share,/etc}/libinput/plugins and possibly XDGCONFIGHOME/libinput/plugins can call a GC cleanup function and leave a dangling pointer. This pointer can then be printed to the system logs, potentially exposing sensitive data once the memory location is re-used. For the exploit to work, lua plugins must be enabled in libinput and loaded by the compositor. If libinputis compiled with -Dautoload-plugins any plugin is loaded automatically (Fedora 43 and 44). The XDGCONFIGHOME directory is only loaded if enabled by the compositor (e.g. mutter 50 does this). The attacker must be able to deploy a lua plugin in one of the directories loaded by libinput.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2453840?
The severity of REDHAT-BUG-2453840 is identified as a potential information disclosure vulnerability due to exposure of sensitive data in system logs.
How do I fix REDHAT-BUG-2453840?
To fix REDHAT-BUG-2453840, ensure that libinput is updated to the latest version that addresses this vulnerability.
What systems are affected by REDHAT-BUG-2453840?
Systems running freedesktop.org libinput with the specified configurations are affected by REDHAT-BUG-2453840.
What type of attack is associated with REDHAT-BUG-2453840?
REDHAT-BUG-2453840 is associated with an attack that exploits a dangling pointer to expose sensitive data.
Can REDHAT-BUG-2453840 be exploited remotely?
While REDHAT-BUG-2453840 requires local access to deploy the lua file, it poses risks if a malicious actor gains that access.