Bug 2213166 (CVE-2023-34969)

Summary:	CVE-2023-34969 dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be delivered
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, bdettelb, caswilli, dffrench, dfreiber, dhalasz, dking, dkuc, fjansen, gzaronik, hkataria, jburrell, jmitchel, jtanner, kaycoth, kshier, ngough, nweather, psegedy, rgodfrey, rogbas, stcannon, sthirugn, tcarlin, tsasak, vkrizan, vkumar, vmugicag, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	dbus 1.15.6, dbus 1.14.8, dbus 1.12.28	Doc Type:	If docs needed, set a value
Doc Text:	An assertion failure vulnerability was found in D-Bus. This issue occurs when a privileged monitoring connection (dbus-monitor, busctl monitor, gdbus monitor, or similar) is active, and a message from the bus driver cannot be delivered to a client connection due to <deny> rules or outgoing message quota. If a privileged user with control over the dbus-daemon is monitoring the message bus traffic using the Monitoring clients like the dbus-monitor or busctl monitor interfaces, then an unprivileged local user with the ability to connect to the same dbus-daemon could send specially crafted request, causing a dbus-daemon to crash, resulting in a denial of service under some circumstances.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2213400, 2213402, 2213396, 2213397, 2213399, 2213401
Bug Blocks:	2212991

Description TEJ RATHI 2023-06-07 09:16:58 UTC

An assertion failure in dbus-daemon when a privileged Monitoring connection (dbus-monitor, busctl monitor, gdbus monitor or similar) is active, and a message from the bus driver cannot be delivered to a client connection due to <deny> rules or outgoing message quota. This is a denial of service if triggered maliciously by a local attacker

In other words, if a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances.

Vulnerable versions:

1.15.x before 1.15.6
1.14.x before 1.14.8
1.12.x before 1.12.28
most end-of-life versions since 1.9.x

Fixed versions:

all since 1.15.6
1.14.x since 1.14.8
1.12.x since 1.12.28

Not vulnerable: end-of-life versions 1.8.x or older do not contain the affected code path.

https://gitlab.freedesktop.org/dbus/dbus/-/issues/457
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1908636.html

Comment 1 TEJ RATHI 2023-06-07 09:17:53 UTC

No CVE has been published yet, but upstream has requested one from Mitre.

Comment 3 TEJ RATHI 2023-06-08 04:27:25 UTC

Created dbus tracking bugs for this issue:

Affects: fedora-all [bug 2213396]


Created mingw-dbus tracking bugs for this issue:

Affects: fedora-all [bug 2213397]

Comment 8 errata-xmlrpc 2023-08-07 08:49:32 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:4498 https://access.redhat.com/errata/RHSA-2023:4498

Comment 9 errata-xmlrpc 2023-08-08 15:10:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:4569 https://access.redhat.com/errata/RHSA-2023:4569