Privilege Escalation Vulnerability in acpi-support Package
Summary
CVE-2014-0484: The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment.". Affects acpi-support versions < 0.142-4. Fixed in 0.142-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The acpi-support package is a crucial component in Debian-based systems, responsible for managing Advanced Configuration and Power Interface (ACPI) features. It enables the operating system to communicate effectively with the hardware, allowing for power management and device configuration. However, prior to version 0.140-5+deb7u3, the package contained a vulnerability that could be exploited by local users to gain elevated privileges, compromising system security.
Vulnerability Detail
The vulnerability, identified as CVE-2014-0484, arises from improper handling of the user's environment within the acpi-support package. This flaw allows local users to manipulate their environment in such a way that they can execute commands with higher privileges than intended. The ramifications of this vulnerability are significant, as it could lead to unauthorized access to sensitive system resources, data breaches, or even complete system compromise. The vulnerability affects multiple versions of the acpi-support package across different Debian releases, making it a widespread concern.
How To Fix
Minimum fixed version
0.142-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade acpi-supportTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, users can mitigate the risk by restricting access to the acpi-support package or by monitoring user activities closely. However, this is only a temporary measure and does not eliminate the underlying vulnerability.
Conclusion
The CVE-2014-0484 vulnerability in the acpi-support package poses a significant risk to Debian-based systems, allowing local users to escalate privileges. It is crucial for users to upgrade to the fixed version to safeguard their systems against potential exploitation. Utilizing tools like Vulert can further enhance security by providing real-time monitoring of open-source vulnerabilities.
See every vulnerability recorded for acpi-support →
FAQ
CVE-2014-0484 is a vulnerability in the acpi-support package that allows local users to gain elevated privileges through manipulation of the user's environment.
The vulnerability affects all versions of the acpi-support package prior to 0.142-4 across various Debian releases.
You can check if your system is affected by using tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your application without any signup.
Failing to address this vulnerability could lead to unauthorized access to sensitive information, potential data breaches, and overall compromise of system integrity.
Yes, restricting access to the acpi-support package and closely monitoring user activities can help mitigate the risk until a proper fix is applied.
Related vulnerabilities
Recent vulnerabilities recorded for acpi-support.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
