[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <Yz6XZSTsVQm7VKia@momentum.pseudorandom.co.uk>
Date: Thu, 6 Oct 2022 09:52:53 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Cc: dbus-security@...ts.freedesktop.org
Subject: dbus denial of service: CVE-2022-42010, -42011, -42012
dbus is the reference implementation of D-Bus, a message bus for
communication between applications and system services.
Evgeny Vereshchagin discovered several ways in which an authenticated
local attacker could cause a crash (denial of service) in
dbus-daemon --system or a custom DBusServer. In uncommon configurations
these could potentially be carried out by an authenticated remote attacker.
Fixed versions:
* dbus 1.14.x >= 1.14.4 (stable branch)
* dbus 1.12.x >= 1.12.24 (old stable branch)
* dbus >= 1.15.2 (development branch)
Older dbus branches such as 1.10.x are EOL and will not receive new
upstream releases.
Vulnerable versions:
* dbus 1.15.x before 1.15.2
* dbus 1.14.x before 1.14.4
* all versions before 1.12.24
CVE-2022-42010 is believed to have been introduced during early dbus
development (before 1.0) and the other two vulnerabilities mentioned
here were regressions in 1.3.0.
Vulnerability details:
* An invalid array of fixed-length elements where the length of the array
is not a multiple of the length of the element would cause an assertion
failure in debug builds or an out-of-bounds read in production builds.
This was a regression in version 1.3.0.
(dbus#413, CVE-2022-42011, fixed by
https://gitlab.freedesktop.org/dbus/dbus/-/commit/079bbf16186e87fb0157adf8951f19864bc2ed69)
* A syntactically invalid type signature with incorrectly nested parentheses
and curly brackets would cause an assertion failure in debug builds.
Similar messages could potentially result in a crash or incorrect message
processing in a production build, although we are not aware of a practical
example. (dbus#418, CVE-2022-42010, fixed by
https://gitlab.freedesktop.org/dbus/dbus/-/commit/9d07424e9011e3bbe535e83043d335f3093d2916)
* A message in non-native endianness with out-of-band Unix file descriptors
would cause a use-after-free and possible memory corruption in production
builds, or an assertion failure in debug builds. This was a regression in
version 1.3.0. (dbus#417, CVE-2022-42012, fixed by
https://gitlab.freedesktop.org/dbus/dbus/-/commit/236f16e444e88a984cf12b09225e0f8efa6c5b44)
Reimplementations of the D-Bus protocol such as systemd's sd-bus (used
in dbus-broker and systemd) and GLib's GDBus (used in gvfs and ibus)
do not share dbus' code for message parsing and validation, so they are
probably unaffected by these issues.
--
Simon McVittie, Collabora Ltd. / Debian
on behalf of the dbus maintainers
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
