Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 539482 (CVE-2015-0245) - <sys-apps/dbus-1.8.16: denial of service in dbus >= 1.4 systemd activation (CVE-2015-0245)
Summary: <sys-apps/dbus-1.8.16: denial of service in dbus >= 1.4 systemd activation (C...
Status: RESOLVED FIXED
Alias: CVE-2015-0245
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: A3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-09 16:38 UTC by Agostino Sarubbo
Modified: 2015-03-07 09:04 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2015-02-09 16:38:53 UTC
From ${URL} :

Bug tracked as: CVE-2015-0245
Bug tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=88811
Versions affected: dbus >= 1.4.0
Versions fixed: >= 1.9.10, 1.8.x >= 1.8.16, 1.6.x >= 1.6.30
Type of vulnerability: CWE-285 Improper Authorization
Exploitable by: local users
Impact: denial of service
Reporter: Simon McVittie, Collabora Ltd.

D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an
asynchronous inter-process communication system, commonly used
for system services or within a desktop session on Linux and other
operating systems.

dbus-daemon can "activate" (auto-start) D-Bus services on-demand when it
receives a message addressed to them. In versions >= 1.4.0 of dbus, it
can do this by using a D-Bus signal to ask systemd to carry out the
actual service start.

systemd sends back an ActivationFailure D-Bus signal if the activation
fails. However, when it receives these signals, dbus-daemon does not
verify that the signal actually came from systemd. A malicious local
user could send repeated ActivationFailure signals in the hope that it
would "win the race" with the genuine signal, causing D-Bus to send back
an error to the client that requested activation.

Mitigation: the system service is not actually prevented from starting
or claiming its well-known bus name, and after it has done so,
subsequent clients can communicate with it as usual.

The recommended fix for stable distributions is to alter system.conf
similar to the attached patch (commit link below), or upgrade to version
1.8.16 or 1.6.30. This restricts the attack to uid 0, making it a
non-issue in practice.

http://cgit.freedesktop.org/dbus/dbus/commit/?id=6dbd09fedc396c53b25ea73c6c8a278beca349c7

The full solution involves additional code changes and has only been
made in the 1.9 development branch so far, but is easy to backport to
1.8 if required (e.g. for environments where uid 0 is not all-powerful
due to use of LSMs). It requires two additional commits:

http://cgit.freedesktop.org/dbus/dbus/commit/?id=aaea59916398d1c590490edb0471a01bcf20e6d7
http://cgit.freedesktop.org/dbus/dbus/commit/?id=03c5e161752fe1ff4925955800ca9c78d09a6e0c



@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-02-10 21:53:52 UTC
10 Feb 2015; Kristian Fiskerstrand <k_f@gentoo.org> +dbus-1.8.16.ebuild:
Security bump for #539482. Proxy commit for ssuominen.

Arches, please stabilize:
=sys-apps/dbus-1.8.16
Stable targets: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Comment 2 Jeroen Roovers (RETIRED) gentoo-dev 2015-02-11 09:28:08 UTC
Stable for HPPA.
Comment 3 Agostino Sarubbo gentoo-dev 2015-02-13 10:34:37 UTC
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2015-02-13 10:35:05 UTC
x86 stable
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2015-02-14 12:42:53 UTC
CVE-2015-0245 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-0245):
  D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x
  before 1.9.10 does not validate the source of ActivationFailure signals,
  which allows local users to cause a denial of service (activation failure
  error returned) by leveraging a race condition involving sending an
  ActivationFailure signal before systemd responds.
Comment 6 Agostino Sarubbo gentoo-dev 2015-02-16 10:24:22 UTC
sparc stable
Comment 7 Markus Meier gentoo-dev 2015-02-17 21:24:58 UTC
arm stable
Comment 8 Agostino Sarubbo gentoo-dev 2015-02-18 08:53:16 UTC
ppc64 stable
Comment 9 Agostino Sarubbo gentoo-dev 2015-02-18 09:18:42 UTC
ppc stable
Comment 10 Agostino Sarubbo gentoo-dev 2015-02-23 11:38:54 UTC
ia64 stable
Comment 11 Agostino Sarubbo gentoo-dev 2015-02-24 10:59:05 UTC
alpha stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 12 Yury German Gentoo Infrastructure gentoo-dev 2015-02-25 04:08:55 UTC
Arches, Thank you for your work.
New GLSA Request filed.

Maintainer(s), please drop the vulnerable version(s).
Comment 13 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-02-28 22:22:44 UTC
+  28 Feb 2015; Kristian Fiskerstrand <k_f@gentoo.org> -dbus-1.8.10.ebuild,
+  -dbus-1.8.12.ebuild:
+  Security cleanup for bug #539482
Comment 14 GLSAMaker/CVETool Bot gentoo-dev 2015-03-07 09:04:26 UTC
This issue was resolved and addressed in
 GLSA 201503-02 at http://security.gentoo.org/glsa/glsa-201503-02.xml
by GLSA coordinator Sergey Popov (pinkbyte).