Security researchers at SUSE have disclosed critical vulnerabilities in InputPlumber, a Linux utility that combines input devices into virtual input devices.
The flaws, tracked as CVE-2025-66005 and CVE-2025-14338, affect the authentication mechanism of the D-Bus system service and could enable local attackers to inject malicious input, execute arbitrary code, and cause denial-of-service conditions.
InputPlumber is primarily utilized in Linux gaming environments and is integrated into Valve’s SteamOS platform.
The vulnerabilities were discovered during a routine security review when an openSUSE community member submitted the package for evaluation.
The SUSE security team identified multiple authentication bypass issues that allowed unprivileged users to access sensitive D-Bus methods without proper authorization.
The first vulnerability, CVE-2025-66005, stems from a complete lack of authorization in the InputManager D-Bus interface in versions prior to v0.63.0.
This flaw enables any local user on the system to access privileged D-Bus methods, potentially leading to information disclosure, local denial-of-service attacks, and privilege escalation within active user sessions.
CVE-2025-14338 addresses issues in versions prior to v0.69.0, in which Polkit authentication was disabled by default and was vulnerable to a race condition.
Even when Polkit support was available as a compile-time option, it was disabled by default, with no straightforward way to enable it.
Additionally, the authentication implementation used the deprecated “unix-process” Polkit subject, which is vulnerable to PID replacement attacks similar to CVE-2013-4288.
The vulnerabilities expose two particularly dangerous D-Bus methods.
The CreateCompositeDevice method allows attackers to perform unauthorized file existence tests, leak sensitive information from restricted files such as/root/.bash_history, and trigger memory exhaustion via malicious input.
The CreateTargetDevice method enables the creation of virtual keyboard devices, allowing attackers to inject arbitrary keystrokes into active desktop sessions or login terminals, potentially achieving code execution under the context of logged-in users.
Following the coordinated disclosure, InputPlumber developers released version v0.69.0, which contains patches for most issues.
The fixes include switching to the “system bus name” Polkit subject, enabling Polkit authentication by default, and implementing systemd hardening measures.
Valve Corporation subsequently released SteamOS version 3.7.20, incorporating the security updates.
However, researchers noted that some aspects remain unresolved. The recommendation to replace file path parameters with file descriptors in the D-Bus API has not yet been implemented in a stable release, leaving potential attack vectors active for administrators who relax Polkit authentication requirements.
| CVE ID | Affected Versions | Description | Fixed Version |
|---|---|---|---|
| CVE-2025-66005 | Before v0.63.0 | Lack of authorization in the InputManager D-Bus interface allows local DoS, information leak, and privilege escalation | v0.63.0+ (partial), v0.69.0 (complete) |
| CVE-2025-14338 | Before v0.69.0 | Lack of authorization in the InputManager D-Bus interface allowing local DoS, information leak, and privilege escalation | v0.69.0 |
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
%20(1).webp?fit=1600,900&ssl=1&description=InputPlumber is primarily utilized in Linux gaming environments and is integrated into Valve's SteamOS platform.){kind=link}