CVE-2024-45752

What it actually does

Unrestricted D-Bus interface in the default configuration permits any local unprivileged process to reconfigure the logid daemon and install arbitrary keyboard macros that execute with elevated privileges.

Why it matters to the business

Attackers with a foothold on an affected workstation can obtain root or administrative rights with a single user interaction, increasing the blast radius of any initial compromise and potentially exposing sensitive data or disrupting operations.

How an attack unfolds

An attacker running as a normal user connects to the exposed D-Bus service, registers a keyboard macro that runs a privileged command, then triggers the macro via a key sequence or synthetic input to execute code as root.

How to fix it

Upgrade github.com/fluxcd/flux2 to 0.29.0 or later, github.com/fluxcd/kustomize-controller to 0.23.0 or later, and github.com/fluxcd/helm-controller to 0.19.0 or later; restrict D-Bus access via policy or disable the service if macros are not required.

How to confirm the fix worked

Verify that the D-Bus policy file denies unprivileged access to the logid interface, confirm the running daemon version matches a fixed release, and test that a non-root user can no longer call configuration methods.

Typical attack path

1. Locate the logid D-Bus service on the session bus
2. Connect without authentication as an unprivileged user
3. Invoke the configuration method to install a malicious macro
4. Trigger the macro through keyboard input or accessibility APIs
5. Obtain elevated shell or execute arbitrary privileged actions

How to detect it

Search system and audit logs for D-Bus method calls to the logid configuration interface from non-root UIDs; look for sudden creation or modification of keyboard macro definitions in user or system configuration files.

What your security team should do

• Immediately apply the listed fixed versions across all affected FluxCD deployments
• Audit D-Bus service files and restrict logid exposure to root-only or authenticated users
• Monitor for unexpected keyboard macro registrations in system logs
• Review EPSS and exploit maturity; no active KEV or ransomware use reported but still prioritize patching