CVE-2022-27818
📋 TL;DR
CVE-2022-27818 is a vulnerability in SWHKD 1.1.5 where the software unsafely uses the /tmp/swhkd.sock pathname, allowing local attackers to cause information leaks or denial of service. This affects systems running SWHKD 1.1.5 with the vulnerable configuration. The issue stems from improper handling of temporary socket files.
💻 Affected Systems
- SWHKD
📦 What is this software?
Swhkd by Waycrate
⚠️ Risk & Real-World Impact
Worst Case
Local attackers could intercept sensitive information or crash the SWHKD service, disrupting hotkey functionality system-wide.
Likely Case
Local users could cause denial of service by interfering with the socket file, preventing SWHKD from functioning properly.
If Mitigated
With proper access controls and patching, the risk is limited to local users with specific permissions.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability involves manipulating the /tmp/swhkd.sock file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.6 and later
Vendor Advisory: https://github.com/waycrate/swhkd/releases
Restart Required: Yes
Instructions:
1. Update SWHKD to version 1.1.6 or later. 2. Stop the SWHKD service. 3. Install the updated version. 4. Restart the SWHKD service.
🔧 Temporary Workarounds
Change socket permissions
linuxSet restrictive permissions on the /tmp/swhkd.sock file to limit access
chmod 600 /tmp/swhkd.sock
Use alternative socket path
linuxConfigure SWHKD to use a socket path outside of /tmp
Modify SWHKD configuration to use a different socket path
🧯 If You Can't Patch
- Restrict access to the /tmp directory for non-privileged users
- Monitor for unauthorized access or modifications to /tmp/swhkd.sock
🔍 How to Verify
Check if Vulnerable:
Check if SWHKD version is 1.1.5 and if /tmp/swhkd.sock exists with insecure permissionsCheck Version:
swhkd --versionVerify Fix Applied:
Verify SWHKD version is 1.1.6 or later and check socket file permissions📡 Detection & Monitoring
Log Indicators:
- Failed SWHKD service starts
- Permission denied errors for /tmp/swhkd.sock
Network Indicators:
- Local socket connection attempts to /tmp/swhkd.sock
SIEM Query:
process:swhkd AND file_path:/tmp/swhkd.sock🔗 References
- http://www.openwall.com/lists/oss-security/2022/04/14/1
- https://github.com/waycrate/swhkd/commit/f70b99dd575fab79d8a942111a6980431f006818
- https://github.com/waycrate/swhkd/releases
- http://www.openwall.com/lists/oss-security/2022/04/14/1
- https://github.com/waycrate/swhkd/commit/f70b99dd575fab79d8a942111a6980431f006818
- https://github.com/waycrate/swhkd/releases
