Summary

Kitty's graphic protocol implementation has several issues:

     File descriptor leak on open failure of e.g. directories
     File existence leak, even in "protected" directories such as proc,
sys, dev
     File size leak
     I was able to crash wayland by probing too many files at once - I am
unsure how reproducible this is.

The causes are fds only being closed on the happy path, policy filtering
happening too late, and excessively default error answerbacks.

A remote server the users is connected to via e.g. SSH can probe the
user's filesystem, and sandboxed processes may be able to learn
information they were not supposed to be able to access.

Upstream did not consider this a security issue, my argument that it is:

It allows an attacker to learn what versions of software are installed,
what software the user is actually using, their linux distribution, what
kernel they are running (same enumeration trick against
/boot/vmlinuz-<version>), etc. This sort of information is useful for
assessing vulnerability to further exploits.

The kernel modules and other paths under /sys can also be use to
fingerprint hardware. Running locally, that PoC is able to check about
4000 kernel modules in one second.

Knowing the length of username is useful to build a tuned
guess-and-check sequence to try to discover the full username.

There are plenty of programs that tend to put files in predictable
locations, for example an IRC client might use ~/.local/log/irc/network
- channel.log which can then be queried with a file existence oracle. In
this case, the file size could even be used to infer usage patterns if
the logs are rotated.