Bug 1186775 (CVE-2015-0245)

Summary:	CVE-2015-0245 dbus: denial of service in dbus systemd activation
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	dking, security-response-team, sisharma, slawomir
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-10 21:02:53 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1186776

Description Vasyl Kaigorodov 2015-01-28 14:16:14 UTC

Tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=88811
Versions affected: dbus >= 1.4.0
Type of vulnerability: CWE-285 Improper Authorization
Exploitable by: local users
Impact: denial of service
Reporter: Simon McVittie, Collabora Ltd.

D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an asynchronous inter-process communication system, commonly used for system services or within a desktop session on Linux and other operating systems.

dbus-daemon can "activate" (auto-start) D-Bus services on-demand when it receives a message addressed to them. In versions >= 1.4.0 of dbus, it can do this by using a D-Bus signal to ask systemd to carry out the actual service start.

systemd sends back an ActivationFailure D-Bus signal if the activation fails. However, when it receives these signals, dbus-daemon does not verify that the signal actually came from systemd. A malicious local user could send repeated ActivationFailure signals in the hope that it would "win the race" with the genuine signal, causing D-Bus to send back an error to the client that requested activation.

Mitigation: the system service is not actually prevented from starting or claiming its well-known bus name, and after it has done so, subsequent clients can communicate with it as usual.

Comment 1 Kurt Seifried 2015-02-26 17:54:06 UTC

This is now public: http://seclists.org/oss-sec/2015/q1/480

Comment 2 Siddharth Sharma 2015-05-04 08:00:20 UTC

Analysis
========

In the code shipped in affected version of dbus it fails to check if a non-systemd process makes dbus-daemon think systemd failed to activate a system service, resulting in an error reply back to the requester, utilizing this attack vector malicious user can send multiple service failure messages resulting local DOS for the user trying to start any service. Attacker can only DOS local user and there is no possibility of arbitrary code execution hence the impact of this vulnerability very low.

Comment 4 Vincent Danen 2016-06-10 21:02:53 UTC

Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.