CVE-2011-2777 in acpid2
Summary
by MITRE
samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2024
The vulnerability identified as CVE-2011-2777 resides within the acpid package, specifically in the powerbtn.sh script located in the samples/powerbtn directory. This issue affects acpid versions 2.0.16 and earlier, representing a privilege escalation flaw that exploits improper handling of the pidof program within the script execution context. The vulnerability manifests when local users manipulate the environment to execute malicious code through a carefully crafted program named kded4, which leverages the DBUS_SESSION_BUS_ADDRESS environment variable to inject commands into the system.
The technical flaw stems from the incorrect usage of the pidof program within the powerbtn.sh script, which is designed to handle power button events through acpid daemon. When the script processes power button events, it improperly relies on pidof to identify running processes, creating a path for privilege escalation. The vulnerability becomes exploitable when a local user creates a program named kded4 and sets the DBUS_SESSION_BUS_ADDRESS environment variable to contain malicious commands. This environment variable typically contains the address of the D-Bus session bus, but in this case it is manipulated to include command injection payloads that get executed with elevated privileges.
The operational impact of this vulnerability is significant as it allows local users to escalate their privileges from standard user level to root access without requiring authentication. The attack vector relies on the victim running a specially crafted program named kded4, which must be placed in a location where it can be executed by the acpid daemon. This creates a scenario where legitimate system processes can be subverted to execute arbitrary commands with root privileges, effectively bypassing normal access controls and privilege boundaries. The vulnerability demonstrates a classic case of insecure program execution and improper environment variable handling that can be exploited to gain unauthorized system access.
The vulnerability aligns with CWE-78, which describes improper neutralization of special elements used in OS commands, and CWE-276, which addresses incorrect permissions for critical resources. From an ATT&CK perspective, this vulnerability maps to T1068, privilege escalation through local exploitation, and T1548.001, abuse of system permissions. The attack requires minimal user interaction beyond placing the malicious kded4 program in the appropriate location and setting the environment variable. Remediation involves updating to acpid version 2.0.17 or later where the pidof usage has been corrected, implementing proper privilege separation in script execution, and ensuring that environment variables are properly sanitized before use in system commands. Additionally, system administrators should audit script execution contexts and verify that critical system components do not execute programs with elevated privileges based on user-controlled input or environment variables.