Description: "Kevin Backhouse of the GitHub Security Lab discovered a denial of service vulnerability[0] in dbus >= 1.3.0. An unprivileged local attacker can cause the system dbus-daemon (dbus-daemon --system) to leak file descriptors (fds) by sending messages with a number of fds that exceeds the allowed number, resulting in truncation. The attacker's connection is (correctly) disconnected, but the fds that were attached to the truncated message are (incorrectly) not closed. By repeating this process, the attacker can make the dbus-daemon reach its RLIMIT_NOFILE limit. When this limit is reached, new connections will fail, and existing connections will be unable to send messages with fds attached, causing denial of service. The same attack is also possible in the uncommon situation where processes of different privilege levels communicate directly using a private D-Bus socket (DBusServer) without going via a dbus-daemon."
https://www.openwall.com/lists/oss-security/2020/06/04/3
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6db3472d7e1afcf3d0e115c81392490cbf9b4d79 commit 6db3472d7e1afcf3d0e115c81392490cbf9b4d79 Author: Lars Wendler <polynomial-c@gentoo.org> AuthorDate: 2020-06-04 18:29:54 +0000 Commit: Lars Wendler <polynomial-c@gentoo.org> CommitDate: 2020-06-04 18:30:04 +0000 sys-apps/dbus: Security bump to version 1.12.18 Bug: https://bugs.gentoo.org/727104 Package-Manager: Portage-2.3.100, Repoman-2.3.22 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> sys-apps/dbus/Manifest | 1 + sys-apps/dbus/dbus-1.12.18.ebuild | 272 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 273 insertions(+)
@maintainer(s), ready for stabilisation?
ppc/ppc64 stable
amd64 stable
arm stable
sparc stable
x86 stable
arm64 stable
hppa stable
s390: ping
This issue was resolved and addressed in GLSA 202007-46 at https://security.gentoo.org/glsa/202007-46 by GLSA coordinator Sam James (sam_c).
Reopening for s390 stabilisation.
Please cleanup. dropping s390.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fbd6d91167cca50b9019e86bd284dc9c83a3700b commit fbd6d91167cca50b9019e86bd284dc9c83a3700b Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2020-10-04 15:56:11 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2020-10-04 15:56:11 +0000 sys-apps/dbus: Cleanup vulnerable 1.12.16 Bug: https://bugs.gentoo.org/727104 Package-Manager: Portage-3.0.8, Repoman-3.0.1 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> sys-apps/dbus/Manifest | 1 - sys-apps/dbus/dbus-1.12.16.ebuild | 272 -------------------------------------- 2 files changed, 273 deletions(-)
Thanks!
