CVE-2024-45752
📋 TL;DR
CVE-2024-45752 allows any unprivileged user to configure the logid daemon via an unrestricted D-Bus service in logiops, enabling malicious keyboard macro configuration. This leads to privilege escalation with minimal user interaction. All systems running logiops through version 0.3.4 in default configuration are affected.
💻 Affected Systems
- logiops
📦 What is this software?
Logiops by Pixlone
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via privilege escalation to root, allowing attacker to execute arbitrary commands, install persistent backdoors, or access sensitive data.
Likely Case
Local privilege escalation allowing attacker to gain administrative privileges and modify system configurations or access restricted files.
If Mitigated
Limited impact if D-Bus access is restricted or logiops is not installed, with only local user account compromise possible.
🎯 Exploit Status
Exploitation requires local user access but minimal technical skill. The vulnerability is in the D-Bus interface which is easily accessible to local users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.3.5 or later
Vendor Advisory: https://github.com/PixlOne/logiops/releases
Restart Required: Yes
Instructions:
1. Check current version with 'logid --version'. 2. Update to version 0.3.5 or later from GitHub releases. 3. Restart the logid daemon or reboot the system.
🔧 Temporary Workarounds
Restrict D-Bus access
linuxConfigure D-Bus policy to restrict access to the logiops service
Create /etc/dbus-1/system.d/logiops.conf with restrictive policy rules
Disable logiops service
linuxStop and disable the logid daemon if not needed
sudo systemctl stop logid
sudo systemctl disable logid
🧯 If You Can't Patch
- Remove or uninstall logiops if not required for system functionality
- Implement strict user access controls and monitor for suspicious D-Bus activity
🔍 How to Verify
Check if Vulnerable:
Check if logiops version is 0.3.4 or earlier with 'logid --version' or check running processes for logidCheck Version:
logid --versionVerify Fix Applied:
Verify version is 0.3.5 or later with 'logid --version' and check D-Bus service permissions📡 Detection & Monitoring
Log Indicators:
- Unusual D-Bus connections to logiops service
- Unexpected logid daemon configuration changes
Network Indicators:
- Local D-Bus traffic to logiops service from non-privileged users
SIEM Query:
process_name='logid' AND event_type='privilege_escalation' OR dbus_service='com.github.pixlone.LogiOps'