CVE-2010-4347 in Linux
Summary
by MITRE
The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/01/2025
The vulnerability described in CVE-2010-4347 represents a significant privilege escalation flaw within the Linux kernel's ACPI subsystem that existed prior to version 2.6.36.2. This issue stems from improper permission handling in the debugfs interface, specifically affecting the custom_method file that is created during ACPI debugging initialization. The flaw allows local attackers to exploit a weak security model that grants overly permissive access rights to sensitive system components.
The technical implementation of this vulnerability resides in the acpi_debugfs_init function located within drivers/acpi/debugfs.c, where the debugfs custom_method file is created with world-readable and world-writable permissions set to 0222. This permission scheme represents a critical security oversight since it allows any local user to modify the ACPI method table entries that are interpreted by the kernel's ACPI interpreter. The ACPI subsystem in Linux is responsible for power management and hardware configuration, making it a prime target for privilege escalation attacks due to its deep integration with kernel operations and hardware control mechanisms.
The operational impact of this vulnerability extends beyond simple local privilege escalation, as it enables attackers to inject malicious ACPI methods that can execute with kernel-level privileges. This capability allows adversaries to manipulate hardware states, access protected memory regions, and potentially escalate their privileges to root level. The vulnerability is particularly concerning because ACPI methods are interpreted by the kernel's core subsystem, meaning that any malicious code injected into these tables executes with the highest possible privileges. This flaw directly relates to CWE-276, which addresses improper privileges, and aligns with ATT&CK technique T1068, which covers privilege escalation through kernel exploits.
The exploitation process involves placing a crafted custom ACPI method into the interpreter tables through the debugfs interface, leveraging the permissive 0222 permissions to modify the system's ACPI method execution environment. This attack vector demonstrates a classic case of insufficient access control in kernel subsystems and represents a failure to properly implement least privilege principles in the kernel's debug interfaces. Organizations running affected kernel versions face significant risk from local attackers who can leverage this vulnerability to gain full system control, potentially leading to data breaches, system compromise, and persistent backdoor access. The vulnerability serves as a reminder of the critical importance of proper permission management in kernel space and the potential consequences when debug interfaces are not properly secured against unauthorized modification.