REDHAT-BUG-2485390: Medium severity libinput libinput vulnerability
A local attacker with /dev/uinput access can inject arbitrary udev properties through the libinput-device-group helper. Depending on downstream udev rules, this can result in root code execution (e.g. via injected REMOVECMD properties executed at device removal time). REMOVECMD is in the default udev rules and expected to be present on virtually all machines.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2485390?
The severity of REDHAT-BUG-2485390 is rated as high (7).
How do I fix REDHAT-BUG-2485390?
To fix REDHAT-BUG-2485390, ensure that access to /dev/uinput is properly restricted to prevent unauthorized access.
What type of systems are affected by REDHAT-BUG-2485390?
REDHAT-BUG-2485390 impacts systems using the libinput library that grant access to /dev/uinput.
What is the potential impact of exploiting REDHAT-BUG-2485390?
Exploiting REDHAT-BUG-2485390 could potentially allow a local attacker to execute arbitrary root code.
Who is at risk from REDHAT-BUG-2485390?
Local users with access to /dev/uinput are at risk from REDHAT-BUG-2485390.