xtrlock: CVE-2016-10894: xtrlock does not block multitouch events

Debian Bug report logs - #830726
xtrlock: CVE-2016-10894: xtrlock does not block multitouch events

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Antoine Amarilli <a3nm@a3nm.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: xtrlock does not block multitouch events

Date: Sun, 10 Jul 2016 16:18:41 -0400

Package: xtrlock
Version: 2.8
Severity: normal
Tags: upstream

Dear Maintainer,

xtrlock appears not to block multitouch events when the session is locked, so
that any user stumbling upon a locked session can still input multitouch events.

One could imagine that this could constitute a security vulnerability (requiring
physical access to the machine).

Steps to reproduce (on a computer with a suitably configured touchscreen):

1. Open chromium (my example of a program that processes multitouch events) and
put it in fullscreen mode.
2. Check that you can pinch and zoom (put two fingers of the screen and move
them closer or further apart to change the zoom level).
3. Run xtrlock to lock the session.
4. With xtrlock running, put one finger on the screen and leave it there (the
mouse pointer with the xtrlock lock icon follows that finger). While doing this,
perform the pinch and zoom with two other fingers.

Observed result:

The pinch and zoom is taken into account by chromium even though the session is
locked.

Expected result:

The event should not be seen by chromium while the session is locked.

-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (650, 'testing'), (600, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages xtrlock depends on:
ii  libc6     2.22-13
ii  libx11-6  2:1.6.3-1

xtrlock recommends no packages.

xtrlock suggests no packages.

-- debconf-show failed

Message #10 received at 830726@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: 830726@bugs.debian.org

Cc: "Antoine Amarilli" <a3nm@a3nm.net>

Subject: Re: xtrlock does not block multitouch events

Date: Sun, 21 Jul 2019 15:36:23 -0300

Hi,

> The pinch and zoom is taken into account by chromium even
> though the session is locked.

I cannot reproduce this. (Can you still?)


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org / chris-lamb.co.uk
       `-

Message #15 received at 830726@bugs.debian.org (full text, mbox, reply):

From: Antoine Amarilli <a3nm@a3nm.net>

To: 830726@bugs.debian.org

Subject: Re: xtrlock does not block multitouch events

Date: Sat, 10 Aug 2019 01:36:17 +0200

[Message part 1 (text/plain, inline)]

Hi Chris,

I can still reproduce this. I just booted an USB key with a live Debian
stable image from
https://cdimage.debian.org/debian-cd/current-live/amd64/bt-hybrid/debian-live-10.0.0-amd64-standard.iso.torrent
on the affected hardware (Lenovo IdeaPad Yoga 13 with an ELAN
touchscreen). It booted to a TTY, so I apt-get installed xserver-xorg,
openbox, slim, chromium, xtrlock, started a graphical session, and I
could reproduce the problem: run chromium, run xtrlock, press one finger
on the screen (the mouse pointer with the padlock icon moves to that
finger), then interact with chromium with the other fingers.

The problem is not actually limited to multitouch events in Chromium
(i.e., not just pinch and zoom), as I can e.g. minimize chromium by
tapping the minimize icon with the second finger while the first finger
"holds" the xtrlock icon, and generally interact with the chromium
interface (though not all interface elements work, for some reason).

I can only see this problem with chromium; I cannot interact with other
windows (e.g., xterm, firefox) in this way. This may be linked to the
fact that the chromium window is not decorated, i.e., it does not have
the openbox decorations.

Are you sure you tried to reproduce it with multiple fingers as above?
Are you sure you are using a touchscreen with multitouch support?

Now that I notice this is not limited to multitouch events, this looks
to me like a genuine vulnerability affecting xtrlock when such hardware
is present (or can be plugged in): an attacker can, e.g., completely
mess around with the chromium settings while the session is "locked" by
xtrlock.

-- 
Antoine Amarilli

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 830726@bugs.debian.org (full text, mbox, reply):

From: "Chris Lamb" <lamby@debian.org>

To: "Antoine Amarilli" <a3nm@a3nm.net>, 830726@bugs.debian.org

Subject: Re: xtrlock does not block multitouch events

Date: Sun, 11 Aug 2019 14:01:18 +0100

severity 830726 + important
thanks

Hi Antoine,

> I can still reproduce this. I just booted an USB key with […]

Sorry, I did not automatically receive your reply. In addition,
perhaps I missed the bit about the multitouch *touchscreen* — I can
now reproduce this on my Dell XPS 13.

Elevating the severity for the time being whilst I investigate more.


Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      lamby@debian.org 🍥 chris-lamb.co.uk
       `-

Message #27 received at 830726@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Antoine Amarilli <a3nm@a3nm.net>, 830726@bugs.debian.org

Subject: Re: Bug#830726: xtrlock does not block multitouch events

Date: Fri, 16 Aug 2019 06:16:00 +0200

Control: tags 830726 + security
Control: retitle 830726 xtrlock: CVE-2016-10894: xtrlock does not block multitouch events

Hi,

This issue has been assigned CVE-2016-10894.

Regards,
Salvatore

Send a report that this bug log contains spam.