Root Escalation Flaw in acpi-support Package
Summary
DSA-2984-2: acpi-support - regression update. Affects acpi-support versions < 0.140-5+deb7u2. Fixed in 0.140-5+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The acpi-support package is a component of the Debian operating system. It provides support for Advanced Configuration and Power Interface (ACPI) functionality, allowing users to manage power and system configurations. The package includes various scripts and utilities that interact with ACPI events and handle power management tasks. However, a root escalation flaw has been discovered in the acpi-support package, which can be exploited by an unprivileged user to execute arbitrary commands as the root user.
Vulnerability Detail
The vulnerability arises from a flaw in the policy-funcs script of the acpi-support package. An unprivileged user can inject the DBUS_SESSION_BUS_ADDRESS environment variable, which is not properly sanitized, allowing them to execute arbitrary commands with root privileges. By exploiting this vulnerability, an attacker could gain complete control over the affected system, potentially leading to unauthorized access, data theft, or further compromise of the system.
How To Fix
Minimum fixed version
0.140-5+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade acpi-supportTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The root escalation flaw in the acpi-support package poses a significant security risk to systems running Debian 7 (wheezy). It is crucial to promptly upgrade the acpi-support package to the fixed version to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for acpi-support →
FAQ
This vulnerability allows an unprivileged user to execute arbitrary commands with root privileges, potentially leading to complete control over the affected system.
This vulnerability specifically affects the acpi-support package in the Debian 7 (wheezy) distribution. Other Debian distributions may have different versions or may not include the vulnerable package.
No, this vulnerability requires local access to the system in order to inject the DBUS_SESSION_BUS_ADDRESS environment variable.
There are no known instances of this vulnerability being actively exploited in the wild.
For more information about this vulnerability, you can refer to the official Debian Security Advisory DSA-2984-2.
Related vulnerabilities
Recent vulnerabilities recorded for acpi-support.
