Bug 2213166 (CVE-2023-34969) - CVE-2023-34969 dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be delivered
Summary: CVE-2023-34969 dbus: dbus-daemon: assertion failure when a monitor is active ...
Keywords:
Status: NEW
Alias: CVE-2023-34969
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2213396 2213397 2213399 2213400 2213401 2213402 2235771
Blocks: 2212991
TreeView+ depends on / blocked
 
Reported: 2023-06-07 09:16 UTC by TEJ RATHI
Modified: 2024-03-18 12:51 UTC (History)
28 users (show)

Fixed In Version: dbus 1.15.6, dbus 1.14.8, dbus 1.12.28
Doc Type: If docs needed, set a value
Doc Text:
An assertion failure vulnerability was found in D-Bus. This issue occurs when a privileged monitoring connection (dbus-monitor, busctl monitor, gdbus monitor, or similar) is active, and a message from the bus driver cannot be delivered to a client connection due to <deny> rules or outgoing message quota. If a privileged user with control over the dbus-daemon is monitoring the message bus traffic using the Monitoring clients like the dbus-monitor or busctl monitor interfaces, then an unprivileged local user with the ability to connect to the same dbus-daemon could send specially crafted request, causing a dbus-daemon to crash, resulting in a denial of service under some circumstances.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:4498 0 None None None 2023-08-07 08:49:33 UTC
Red Hat Product Errata RHSA-2023:4569 0 None None None 2023-08-08 15:11:01 UTC
Red Hat Product Errata RHSA-2023:5193 0 None None None 2023-09-18 13:57:46 UTC

Description TEJ RATHI 2023-06-07 09:16:58 UTC 
An assertion failure in dbus-daemon when a privileged Monitoring connection (dbus-monitor, busctl monitor, gdbus monitor or similar) is active, and a message from the bus driver cannot be delivered to a client connection due to <deny> rules or outgoing message quota. This is a denial of service if triggered maliciously by a local attacker

In other words, if a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances.

Vulnerable versions:

1.15.x before 1.15.6
1.14.x before 1.14.8
1.12.x before 1.12.28
most end-of-life versions since 1.9.x

Fixed versions:

all since 1.15.6
1.14.x since 1.14.8
1.12.x since 1.12.28

Not vulnerable: end-of-life versions 1.8.x or older do not contain the affected code path.

https://gitlab.freedesktop.org/dbus/dbus/-/issues/457
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1908636.html
Comment 1 TEJ RATHI 2023-06-07 09:17:53 UTC 
No CVE has been published yet, but upstream has requested one from Mitre.
Comment 3 TEJ RATHI 2023-06-08 04:27:25 UTC 
Created dbus tracking bugs for this issue:

Affects: fedora-all [bug 2213396]


Created mingw-dbus tracking bugs for this issue:

Affects: fedora-all [bug 2213397]
Comment 8 errata-xmlrpc 2023-08-07 08:49:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4498 https://access.redhat.com/errata/RHSA-2023:4498
Comment 9 errata-xmlrpc 2023-08-08 15:10:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4569 https://access.redhat.com/errata/RHSA-2023:4569
Comment 11 errata-xmlrpc 2023-09-18 13:57:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:5193 https://access.redhat.com/errata/RHSA-2023:5193
Note You need to log in before you can comment on or make changes to this bug.