Bug 2462795 (CVE-2026-128885)

AI_ONLY_REPORT
package: dbus-1.14.10-5.el10
------
Summary: Buffer Overflow in _dbus_poll Fallback via select(): stack  
out-of-bounds write in the Unix `select()` fallback when `FD_SET()` is  
called with a file descriptor greater than or equal to `FD_SETSIZE`.
Requirements to exploit: A local attacker needs access to an affected  
`dbus-daemon` instance that is built or configured to use the Unix  
`select()` fallback (`BROKEN_POLL` or `!HAVE_POLL`), plus enough concurrent  
connections or watched descriptors to force a daemon-side file descriptor  
to `>= FD_SETSIZE` while the process can open more than 1024 fds.
Component affected: `dbus-1.14.10-5.el10`; Unix polling implementation in  
`dbus/dbus-sysdeps-unix.c`, function `_dbus_poll()`, reachable through the  
pollable-set mainloop path when the `select()` fallback is compiled in.
Version affected: `dbus-1.14.10-5.el10` when built in Unix configurations  
that take the `select()` fallback (`BROKEN_POLL` or `!HAVE_POLL`) and can  
allocate file descriptors `>= FD_SETSIZE`.
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - 5.5 (MEDIUM)
AV:L - Triggering the issue requires same-host access to a D-Bus  
endpoint and the ability to drive the daemon's local file descriptor usage  
above `FD_SETSIZE`.
AC:L - Once the `select()` fallback is active, the missing bound check  
is direct and no race or special timing is required beyond accumulating  
enough descriptors.
PR:L - The attacker needs low-privileged local access to create and  
retain many client connections or otherwise influence the daemon's watched  
descriptors.
UI:N - No user interaction is required.
S:U - The impact is within the security scope of the affected daemon.
C:N - The available evidence does not show unauthorized information  
disclosure.
I:N - The available evidence does not show unauthorized data  
modification.
A:H - The supported outcome is daemon crash or abort, causing loss of  
service availability.
Impact: Moderate. Under Red Hat's severity guidance, the strongest  
supported impact is a denial of service in builds that use the `select()`  
emulation path, but exploitation depends on a platform- or  
configuration-specific fallback and on driving fd allocation beyond  
`FD_SETSIZE`. That makes the issue less severe than an easily exploitable  
default-path flaw, while still representing a meaningful availability risk  
where the fallback is in use.
Embargo: no
Reason: The established impact is a local, configuration-dependent  
availability issue, and the current evidence does not show easy remote  
compromise or a need for extended coordinated handling.
Acknowledgement: Aisle Research
Vulnerability Details: The Unix implementation of `_dbus_poll()` emulates  
`poll()` with `select()` when `HAVE_POLL` is unavailable or `BROKEN_POLL`  
is defined. In that fallback, each `DBusPollFD` entry is copied into  
`fd_set` bitmaps without verifying that the descriptor value is smaller  
than `FD_SETSIZE`. On systems where `fd_set` has a fixed bound, calling  
`FD_SET()` with `fd >= FD_SETSIZE` causes an out-of-bounds write into  
stack-allocated `fd_set` storage.
```c
for (i = 0; i < n_fds; i++)
{
DBusPollFD *fdp = &fds[i];
if (fdp->events & _DBUS_POLLIN)
FD_SET (fdp->fd, &read_set);
if (fdp->events & _DBUS_POLLOUT)
FD_SET (fdp->fd, &write_set);
FD_SET (fdp->fd, &err_set);
max_fd = MAX (max_fd, fdp->fd);
}
```
The source tree automatically defines `BROKEN_POLL` on `_APPLE_` and  
`__INTERIX`, so this is an intentional fallback path rather than dead code.  
The daemon main loop can reach `_dbus_poll()` through  
`dbus/dbus-mainloop.c` and `dbus/dbus-pollable-set-poll.c`. Session-style  
configuration in the package allows very high connection counts  
(`max_completed_connections=100000`, `max_connections_per_user=100000`),  
and the daemon attempts to raise its file descriptor limit during startup  
where supported. Those conditions make `fd >= FD_SETSIZE` plausible in  
affected fallback builds. The most direct reproducer therefore uses a  
session-style configuration; default system-bus per-user limits are lower  
and may make the same condition harder to trigger for a single local user.  
However, the trigger is conditional on the `select()` fallback being  
compiled and used; the available evidence does not establish the same  
behavior for default Linux `poll()` or `epoll` code paths. The strongest  
directly supported impact is denial of service through daemon crash;  
although the primitive is a stack out-of-bounds write, code execution is  
not demonstrated here.
Steps to reproduce:
1. Build or use a Unix configuration of `dbus-1.14.10-5.el10` that takes  
the `select()` fallback (`BROKEN_POLL` or `!HAVE_POLL`).
2. Start `dbus-daemon` with a session-style configuration and an open-files  
limit above `FD_SETSIZE` (typically greater than 1024).
3. Open and retain enough concurrent client connections to force  
daemon-side file descriptor numbers to `>= FD_SETSIZE`.
4. Trigger ordinary event-loop activity so `_dbus_poll()` processes the  
watch set.
5. Observe a crash or a sanitizer report at or near `FD_SET()` inside  
`_dbus_poll()`.
Mitigation: If an immediate code fix is not available, avoid builds that  
use the `select()` fallback and prefer configurations that take the normal  
`poll()` or `epoll` paths. Where the fallback must remain enabled, keeping  
the daemon's effective file descriptor limit at or below `FD_SETSIZE`, or  
lowering connection limits so daemon-side descriptors cannot reach that  
range, prevents this specific trigger but does not remove the underlying  
flaw.
Proposed Fix: Reject negative or oversized file descriptors before any  
`FD_SET()` call and return an error instead of corrupting the `fd_set`  
buffers.
```diff
diff --git a/dbus/dbus-sysdeps-unix.c b/dbus/dbus-sysdeps-unix.c
@@ -3162,6 +3162,13 @@ _dbus_poll (DBusPollFD *fds,
for (i = 0; i < n_fds; i++)
{
DBusPollFD *fdp = &fds[i];
+      if (fdp->fd < 0 || fdp->fd >= FD_SETSIZE)
+        {
+          errno = EINVAL;
+          return -1;
+        }
+
if (fdp->events & _DBUS_POLLIN)
FD_SET (fdp->fd, &read_set);
```
------
This report was generated using AI technology. Always review AI-generated  
content prior to use