Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <Yz6XZSTsVQm7VKia@momentum.pseudorandom.co.uk>
Date: Thu, 6 Oct 2022 09:52:53 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Cc: dbus-security@...ts.freedesktop.org
Subject: dbus denial of service: CVE-2022-42010, -42011, -42012

dbus is the reference implementation of D-Bus, a message bus for
communication between applications and system services.

Evgeny Vereshchagin discovered several ways in which an authenticated
local attacker could cause a crash (denial of service) in
dbus-daemon --system or a custom DBusServer. In uncommon configurations
these could potentially be carried out by an authenticated remote attacker.

Fixed versions:

* dbus 1.14.x >= 1.14.4 (stable branch)
* dbus 1.12.x >= 1.12.24 (old stable branch)
* dbus >= 1.15.2 (development branch)

Older dbus branches such as 1.10.x are EOL and will not receive new
upstream releases.

Vulnerable versions:

* dbus 1.15.x before 1.15.2
* dbus 1.14.x before 1.14.4
* all versions before 1.12.24

CVE-2022-42010 is believed to have been introduced during early dbus
development (before 1.0) and the other two vulnerabilities mentioned
here were regressions in 1.3.0.

Vulnerability details:

* An invalid array of fixed-length elements where the length of the array
  is not a multiple of the length of the element would cause an assertion
  failure in debug builds or an out-of-bounds read in production builds.
  This was a regression in version 1.3.0.
  (dbus#413, CVE-2022-42011, fixed by
  https://gitlab.freedesktop.org/dbus/dbus/-/commit/079bbf16186e87fb0157adf8951f19864bc2ed69)

* A syntactically invalid type signature with incorrectly nested parentheses
  and curly brackets would cause an assertion failure in debug builds.
  Similar messages could potentially result in a crash or incorrect message
  processing in a production build, although we are not aware of a practical
  example. (dbus#418, CVE-2022-42010, fixed by
  https://gitlab.freedesktop.org/dbus/dbus/-/commit/9d07424e9011e3bbe535e83043d335f3093d2916)

* A message in non-native endianness with out-of-band Unix file descriptors
  would cause a use-after-free and possible memory corruption in production
  builds, or an assertion failure in debug builds. This was a regression in
  version 1.3.0. (dbus#417, CVE-2022-42012, fixed by
  https://gitlab.freedesktop.org/dbus/dbus/-/commit/236f16e444e88a984cf12b09225e0f8efa6c5b44)

Reimplementations of the D-Bus protocol such as systemd's sd-bus (used
in dbus-broker and systemd) and GLib's GDBus (used in gvfs and ibus)
do not share dbus' code for message parsing and validation, so they are
probably unaffected by these issues.

-- 
Simon McVittie, Collabora Ltd. / Debian
on behalf of the dbus maintainers

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.