[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Yz722hsDFWr/hqGb@momentum.pseudorandom.co.uk>
Date: Thu, 6 Oct 2022 16:40:10 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com, dbus-security@...ts.freedesktop.org
Cc: Demi Marie Obenour <demi@...isiblethingslab.com>
Subject: Re: dbus denial of service: CVE-2022-42010, -42011,
-42012
On Thu, 06 Oct 2022 at 10:53:15 -0400, Demi Marie Obenour wrote:
> Is the memory corruption potentially exploitable for local privilege
> escalation?
It is not known to be, but also not known not to be. I'm sure a
sufficiently creative attacker can convert almost any memory corruption
into arbitrary code execution, but exploit development is not my job
(I'd rather fix the vulnerabilities!), so I have not attempted to
weaponize this.
> Are clients using libdbus vulnerable if they are behind dbus-broker?
I don't maintain dbus-broker and have not tested or audited it, so
I don't know how much validation it does. I would hope that it would
detect and prevent CVE-2022-42011 and CVE-2022-42010 (which involve
invalid messages), but probably not CVE-2022-42012 (which involves a
message that is odd but technically valid).
smcv
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
