CVE-2010-4347
published 2010-12-22CVE-2010-4347: The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by…
PriorityP432medium6.9CVSS 2.0
AVLACMAuNCCICAC
EXPLOIT
EPSS
2.20%
80.7th percentile
The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | < 2.6.36.2 | 2.6.36.2 |
| linux | linux_kernel | <= 2.6.9 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 3.11.0-12.19 | 3.11.0-12.19 |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_real_time_extension | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.9MEDIUM
vendor_redhat6.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions
vendor_redhat·2011-02-22·CVSS 6.9
CVE-2011-1021 [MEDIUM] kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions
kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions
drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by leveraging root privileges to write to the /sys/kernel/debug/acpi/custom_method file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4347.
Statement: The version of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and 6 as they did not include upstream commit a1a541d8 and a25ee920 that introduced the problem. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1253.html.
Notes:
This requires debugfs to be mounted on a local system in order to have access
to the custom_method file. Debugfs is not mounted by default. Y
Red Hat
kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method
vendor_redhat·2010-11-13·CVSS 6.9
CVE-2010-4347 [MEDIUM] kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method
kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method
The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 4, 5, and 6 as they did not include upstream commit a1a541d8 and a25ee920 that introduced the problem. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0330.html.
Notes:
This requires debugfs to be mounted on a local system in order to have access to the custom_method file. Debugf
GHSA
GHSA-42f2-xvqw-p5x2: drivers/acpi/debugfs
ghsa_unreviewed·2022-05-17·CVSS 6.9
CVE-2011-1021 [MEDIUM] GHSA-42f2-xvqw-p5x2: drivers/acpi/debugfs
drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by leveraging root privileges to write to the /sys/kernel/debug/acpi/custom_method file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4347.
GHSA
GHSA-vpxp-m77w-89hf: The ACPI subsystem in the Linux kernel before 2
ghsa_unreviewed·2022-05-13
CVE-2010-4347 [MEDIUM] CWE-269 GHSA-vpxp-m77w-89hf: The ACPI subsystem in the Linux kernel before 2
The ACPI subsystem in the Linux kernel before 2.6.36.2 uses 0222 permissions for the debugfs custom_method file, which allows local users to gain privileges by placing a custom ACPI method in the ACPI interpreter tables, related to the acpi_debugfs_init function in drivers/acpi/debugfs.c.
OSV
CVE-2011-1021: drivers/acpi/debugfs
osv·2012-06-21·CVSS 6.9
CVE-2011-1021 [MEDIUM] CVE-2011-1021: drivers/acpi/debugfs
drivers/acpi/debugfs.c in the Linux kernel before 3.0 allows local users to modify arbitrary kernel memory locations by leveraging root privileges to write to the /sys/kernel/debug/acpi/custom_method file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4347.
No detection rules found.
arXiv
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
arxiv_fulltext·2025-11-21
Characteristics, Root Causes, and Detection of Incomplete Security Bug Fixes in the Linux Kernel
Characteristics, Root Causes, and Detection of
Incomplete Security Bug Fixes in the Linux Kernel
Qiang Liu^1All work was done by Aug., 2022.,
Wenlong Zhang^1,
Muhui Jiang^2,1,
Lei Wu^1,
Yajin Zhou^1
^1Zhejiang University,
^2The Hong Kong Polytechnic University
## Abstract
Security bugs in the Linux kernel emerge endlessly and have attracted much
attention.
However, fixing security bugs in the Linux kernel could be incomplete due to
human mistakes.
Specifically, an incomplete fix fails to repair all the original security
defects in the software, fails to properly repair the original security defects,
or introduces new ones.
In this paper, we study the fixes of incomplete security bugs in the Linux
kernel for the first time, and reveal their characteristics, root causes as well
as de
Bugzilla
CVE-2011-1021 kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions
bugzilla·2011-02-28·CVSS 6.9
CVE-2011-1021 [MEDIUM] CVE-2011-1021 kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions
CVE-2011-1021 kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions
Since /sys/kernel/debug/acpi/custom_method can be used to write arbitrary kernel memory (http://jon.oberheide.org/files/american-sign-language.c), it should be able to be left out of the kernel for system owners that want to be as defensive as possible to potential attacks, even from the root user. See as examples: CONFIG_DEVKMEM, CONFIG_STRICT_DEVMEM, and /proc/sys/kernel/modules_disabled.
https://lkml.org/lkml/2011/2/22/369
Discussion:
I believe this is the upstream solution
ed3aada1bf34c5a9e98af167f125f8a740fc726a
---
Statement:
The version of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, and 6 as they did not include upstream commit a1a541d8 and a25ee920 that introduced the pr
Bugzilla
CVE-2010-4347 kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method
bugzilla·2010-12-16·CVSS 6.9
CVE-2010-4347 [MEDIUM] CVE-2010-4347 kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method
CVE-2010-4347 kernel: local privilege escalation via /sys/kernel/debug/acpi/custom_method
Reported by Dave Jones, currently we have:
--w--w--w-. 1 root root 0 2010-11-11 14:56 /sys/kernel/debug/acpi/custom_method
which is just crazy. Change this to --w-------.
This custom_method file allows to inject custom ACPI methods into the ACPI interpreter tables. This control file was introduced with world writeable permissions in Linux Kernel 2.6.33.
Introduced in:
http://git.kernel.org/linus/a1a541d86f50a9957beeedb122a035870d602647
http://git.kernel.org/linus/a25ee9200eef07377e1703697afbb5d81f89e500
Fixed in:
http://git.kernel.org/linus/ed3aada1bf34c5a9e98af167f125f8a740fc726a
Discussion:
Statement:
This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise L
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ed3aada1bf34c5a9e98af167f125f8a740fc726ahttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://openwall.com/lists/oss-security/2010/12/15/3http://openwall.com/lists/oss-security/2010/12/15/7http://secunia.com/advisories/42778http://www.exploit-db.com/exploits/15774/http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.securityfocus.com/bid/45408http://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=663542https://exchange.xforce.ibmcloud.com/vulnerabilities/64155http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ed3aada1bf34c5a9e98af167f125f8a740fc726ahttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://openwall.com/lists/oss-security/2010/12/15/3http://openwall.com/lists/oss-security/2010/12/15/7http://secunia.com/advisories/42778http://www.exploit-db.com/exploits/15774/http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.securityfocus.com/bid/45408http://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=663542https://exchange.xforce.ibmcloud.com/vulnerabilities/64155
2010-12-22
Published