CVE-2011-4124
📋 TL;DR
CVE-2011-4124 is a privilege escalation vulnerability in Calibre's Linux mount helper that allows local attackers to execute arbitrary commands with root privileges. The vulnerability exists due to improper input validation when processing mount arguments, enabling argument injection. This affects Linux systems running vulnerable versions of Calibre.
💻 Affected Systems
- Calibre
📦 What is this software?
Calibre by Calibre Ebook
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges on the system, enabling complete system compromise, data theft, and persistence.
Likely Case
Local user or malicious process escalates privileges to root, potentially installing malware, accessing sensitive data, or modifying system configurations.
If Mitigated
With proper privilege separation and SELinux/apparmor enforcement, impact limited to specific mount operations rather than full root access.
🎯 Exploit Status
Exploit code is publicly available and trivial to execute. Requires local access to the system but no authentication beyond standard user privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.8.42 and later
Vendor Advisory: https://bugs.launchpad.net/calibre/+bug/885027
Restart Required: No
Instructions:
1. Update Calibre to version 0.8.42 or later using your package manager. 2. For Ubuntu/Debian: sudo apt-get update && sudo apt-get install calibre. 3. For other distributions, use appropriate package manager or download from calibre-ebook.com.
🔧 Temporary Workarounds
Remove setuid from mount helper
linuxRemove setuid permissions from the vulnerable mount helper binary to prevent privilege escalation
sudo chmod u-s /usr/lib/calibre/calibre-mount-helper
Disable mount helper
linuxRemove or rename the mount helper binary to prevent exploitation
sudo mv /usr/lib/calibre/calibre-mount-helper /usr/lib/calibre/calibre-mount-helper.disabled
🧯 If You Can't Patch
- Implement strict SELinux or AppArmor policies to restrict the mount helper's capabilities
- Remove Calibre from production systems or restrict user access to systems with vulnerable versions
🔍 How to Verify
Check if Vulnerable:
Check if calibre-mount-helper exists and has setuid bit set: ls -la /usr/lib/calibre/calibre-mount-helper 2>/dev/null | grep '^...s'Check Version:
calibre --version | head -1Verify Fix Applied:
Verify Calibre version is 0.8.42 or later: calibre --version | head -1📡 Detection & Monitoring
Log Indicators:
- Unusual mount operations via calibre-mount-helper
- Process execution with unexpected arguments from calibre-mount-helper
Network Indicators:
- Not applicable - local privilege escalation only
SIEM Query:
process.name:"calibre-mount-helper" AND process.args:*mount* AND process.user:root🔗 References
- https://bugs.launchpad.net/calibre/+bug/885027
- https://git.zx2c4.com/calibre-mount-helper-exploit/about/
- https://lwn.net/Articles/464824/
- https://www.openwall.com/lists/oss-security/2011/11/02/2
- https://bugs.launchpad.net/calibre/+bug/885027
- https://git.zx2c4.com/calibre-mount-helper-exploit/about/
- https://lwn.net/Articles/464824/
- https://www.openwall.com/lists/oss-security/2011/11/02/2
