Bug 352534 (CVE-2011-1159)

Summary:	<sys-power/acpid-2.0.9: Local Denial of Service (CVE-2011-1159)
Product:	Gentoo Security	Reporter:	Tim Sammut (RETIRED) <underling>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	mobile+disabled
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://www.openwall.com/lists/oss-security/2011/01/19/4
See Also:	https://bugzilla.redhat.com/show_bug.cgi?id=688698
Whiteboard:	B3 [glsa?]
Package list:		Runtime testing required:	---

Description Tim Sammut (RETIRED) gentoo-dev

2011-01-23 19:46:01 UTC

From $URL:

I. Blocking write.

I.1. Description.

acpid informs unprivileged processes about acpi events via UNIX socket.
This socket is in blocking mode.  If unprivileged process stops reading
data from the socket then, in some time, the socket queue fills up
leading to hanging privileged acpid daemon.  The daemon hangs until the
socket peer process reads some portion of the queued data or the peer
process exits/is killed.

Comment 1 Paweł Hajdan, Jr. (RETIRED) gentoo-dev

2011-03-21 14:05:39 UTC

There are some proposed patches, see https://bugzilla.redhat.com/show_bug.cgi?id=688698

Comment 2 Samuli Suominen (RETIRED) gentoo-dev

2011-09-08 10:42:10 UTC

@security: https://bugzilla.redhat.com/show_bug.cgi?id=688698#c6 seems to indicate the problem is already fixed in 2.0.9 which is our stable version

right?

Comment 3 Tim Sammut (RETIRED) gentoo-dev

2011-09-08 13:37:45 UTC

(In reply to comment #2)
> @security: https://bugzilla.redhat.com/show_bug.cgi?id=688698#c6 seems to
> indicate the problem is already fixed in 2.0.9 which is our stable version
> 
> right?

Indeed, thanks, Samuli. From the 2.0.9 ChangeLog:

  - Added fcntl() for O_NONBLOCK on the client sockets.  This prevents acpid
    from hanging if a client behaves badly.  (sock.c)  (Vasiliy Kulikov)
    From: http://www.openwall.com/lists/oss-security/2011/01/19/4

GLSA Vote: no.

Comment 4 GLSAMaker/CVETool Bot gentoo-dev

2011-10-07 21:41:58 UTC

CVE-2011-1159 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1159):
  acpid.c in acpid before 2.0.9 does not properly handle a situation in which
  a process has connected to acpid.socket but is not reading any data, which
  allows local users to cause a denial of service (daemon hang) via a crafted
  application that performs a connect system call but no read system calls.

Comment 5 Pierre-Yves Rofes (RETIRED) gentoo-dev

2011-10-08 21:11:53 UTC

voting noglsa too, and closing.