Bug 727104 (CVE-2020-12049) – <sys-apps/dbus-1.12.18: Denial of service via file descriptor leak (CVE-2020-12049)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Sam James 2020-06-04 11:01:02 UTC]

Description:
"Kevin Backhouse of the GitHub Security Lab discovered a denial of service
vulnerability[0] in dbus >= 1.3.0. An unprivileged local attacker can cause
the system dbus-daemon (dbus-daemon --system) to leak file descriptors
(fds) by sending messages with a number of fds that exceeds the allowed
number, resulting in truncation. The attacker's connection is (correctly)
disconnected, but the fds that were attached to the truncated message
are (incorrectly) not closed. By repeating this process, the attacker
can make the dbus-daemon reach its RLIMIT_NOFILE limit. When this limit
is reached, new connections will fail, and existing connections will be
unable to send messages with fds attached, causing denial of service.

The same attack is also possible in the uncommon situation where processes
of different privilege levels communicate directly using a private D-Bus
socket (DBusServer) without going via a dbus-daemon."

[Comment 1 Sam James 2020-06-04 11:01:16 UTC]

https://www.openwall.com/lists/oss-security/2020/06/04/3

[Comment 2 Larry the Git Cow 2020-06-04 18:30:09 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6db3472d7e1afcf3d0e115c81392490cbf9b4d79

commit 6db3472d7e1afcf3d0e115c81392490cbf9b4d79
Author:     Lars Wendler <[e-mail]>
AuthorDate: 2020-06-04 18:29:54 +0000
Commit:     Lars Wendler <[e-mail]>
CommitDate: 2020-06-04 18:30:04 +0000

    sys-apps/dbus: Security bump to version 1.12.18
    
    Bug: https://bugs.gentoo.org/727104
    Package-Manager: Portage-2.3.100, Repoman-2.3.22
    Signed-off-by: Lars Wendler <[e-mail]>

 sys-apps/dbus/Manifest            |   1 +
 sys-apps/dbus/dbus-1.12.18.ebuild | 272 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 273 insertions(+)

[Comment 3 Sam James 2020-06-08 18:54:54 UTC]

@maintainer(s), ready for stabilisation?

[Comment 4 Sergei Trofimovich (RETIRED) 2020-06-14 20:23:28 UTC]

ppc/ppc64 stable

[Comment 5 Agostino Sarubbo 2020-06-15 15:01:52 UTC]

amd64 stable

[Comment 6 Agostino Sarubbo 2020-06-15 15:05:06 UTC]

arm stable

[Comment 7 Agostino Sarubbo 2020-06-15 15:13:15 UTC]

sparc stable

[Comment 8 Agostino Sarubbo 2020-06-15 15:16:31 UTC]

x86 stable

[Comment 9 Sam James 2020-06-17 14:25:06 UTC]

arm64 stable

[Comment 10 Rolf Eike Beer 2020-06-18 17:38:34 UTC]

hppa stable

[Comment 11 Sam James 2020-07-17 00:03:30 UTC]

s390: ping

[Comment 12 GLSAMaker/CVETool Bot 2020-07-27 01:02:16 UTC]

This issue was resolved and addressed in
 GLSA 202007-46 at https://security.gentoo.org/glsa/202007-46
by GLSA coordinator Sam James (sam_c).

[Comment 13 Sam James 2020-07-27 01:22:24 UTC]

Reopening for s390 stabilisation.

[Comment 14 John Helmert III 2020-09-20 16:15:44 UTC]

s390: ping

[Comment 15 Sam James 2020-10-04 13:54:12 UTC]

Please cleanup. dropping s390.

[Comment 16 Larry the Git Cow 2020-10-04 16:07:15 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fbd6d91167cca50b9019e86bd284dc9c83a3700b

commit fbd6d91167cca50b9019e86bd284dc9c83a3700b
Author:     Andreas Sturmlechner <[e-mail]>
AuthorDate: 2020-10-04 15:56:11 +0000
Commit:     Andreas Sturmlechner <[e-mail]>
CommitDate: 2020-10-04 15:56:11 +0000

    sys-apps/dbus: Cleanup vulnerable 1.12.16
    
    Bug: https://bugs.gentoo.org/727104
    Package-Manager: Portage-3.0.8, Repoman-3.0.1
    Signed-off-by: Andreas Sturmlechner <[e-mail]>

 sys-apps/dbus/Manifest            |   1 -
 sys-apps/dbus/dbus-1.12.16.ebuild | 272 --------------------------------------
 2 files changed, 273 deletions(-)

[Comment 17 Sam James 2020-10-04 16:12:30 UTC]

Thanks!