Privilege Escalation Vulnerability in acpid Package
Summary
DEBIAN-CVE-2011-2777: samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRES... Affects acpid versions < 1:2.0.14-1. Fixed in 1:2.0.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The acpid package, also known as acpid2, is a daemon that listens for Advanced Configuration and Power Interface (ACPI) events and executes scripts based on those events. It is commonly used in Linux systems to manage power-related events such as button presses and lid closures. The package is essential for providing a responsive user experience in managing power states. However, certain versions of acpid have been found to be vulnerable to a privilege escalation issue, which could allow local users to gain unauthorized access to elevated privileges.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2011-2777 arises from a flaw in the samples/powerbtn/powerbtn.sh script within acpid versions 2.0.16 and earlier. The script incorrectly utilizes the pidof program, which can be exploited by local users. By running a program named 'kded4' and setting the DBUS_SESSION_BUS_ADDRESS environment variable to contain specific commands, an attacker can gain elevated privileges. This vulnerability poses a significant risk as it allows unauthorized users to execute commands with higher privileges, potentially compromising system security.
How To Fix
Minimum fixed version
1:2.0.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade acpidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the acpid service or modify the environment variables to prevent unauthorized access. However, the best course of action is to update to the patched version as mentioned above.
Conclusion
The privilege escalation vulnerability in the acpid package poses a significant risk to system security. It is crucial for users to update to the patched version to mitigate this risk. By staying informed and utilizing tools like Vulert, users can effectively monitor and manage vulnerabilities in their software.
See every vulnerability recorded for acpid →
FAQ
The vulnerability allows local users to escalate their privileges, potentially leading to unauthorized access and control over the system.
Versions of acpid prior to 1:2.0.14-1 are affected by this vulnerability.
You can check your system's acpid version using the command 'apt-cache policy acpid'. If it is below 1:2.0.14-1, it is vulnerable.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for acpid.
