Bug 2472930 (CVE-2026-128886)

AI_ONLY_REPORT
package: dbus-1.16.2-1.1.hum1
------
Summary: Server accept watch can be stalled by blocking nonce-tcp  
accept_with_noncefile path: an unauthenticated client can keep the  
`nonce-tcp` pre-authentication accept path occupied by withholding nonce  
bytes, causing a denial of service for the affected listener.
Requirements to exploit: The attacker must be able to establish a TCP  
connection to a reachable `nonce-tcp` listener exposed by this package and  
keep it open without sending the full 16-byte nonce. No authentication or  
knowledge of the nonce is required. If the listener is only bound to  
loopback, exploitation requires local access or another way to originate  
loopback traffic on the host.
Component affected: `dbus-1.16.2-1.1.hum1`, `dbus/dbus-server-socket.c`  
(`socket_handle_watch`) and `dbus/dbus-nonce.c`  
(`_dbus_accept_with_noncefile`, `do_check_nonce`).
Version affected: `dbus-1.16.2-1.1.hum1` when a reachable `nonce-tcp`  
listener is enabled. The available history confirms the behavior in the  
imported `dbus-1.16.2` snapshot but does not precisely establish the first  
introducing version.
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.2 (MEDIUM)
AV:L - Exploitation requires reachability to a `nonce-tcp` listener.  
Broad remote exposure is not inherent to the package, so the base score  
assumes local reachability to the affected listener.
AC:L - The attack is a simple connect-and-hold or partial-send condition  
with no nonce knowledge, race, or special timing requirement.
PR:N - The stall occurs before authentication.
UI:N - No user interaction is required.
S:U - The impact remains within the affected service scope.
C:N - No confidentiality impact is established.
I:N - No integrity impact is established.
A:H - A single unauthenticated connection can keep the nonce  
pre-authentication accept path occupied and block or significantly delay  
additional clients on the affected listener.
Impact: Moderate. Under Red Hat's severity guidance this is better  
classified as Moderate than Important because it is an availability flaw in  
a configuration-dependent transport, and broader remote exposure is not  
established as inherent to the package. Where `nonce-tcp` is enabled and  
attacker-reachable, the availability impact on that listener can still be  
significant.
Embargo: no
Reason: This is an availability-only issue with straightforward  
mitigation and configuration-dependent exposure. Broad default remote  
exposure is not established, so non-embargoed coordinated handling is more  
proportionate.
Acknowledgement: Aisle Research
Vulnerability Details: In `socket_handle_watch()`, a `noncefile` listener  
calls `_dbus_accept_with_noncefile()` directly while handling readability  
on the listening socket. The accept helper performs nonce verification  
before the later nonblocking handoff in `handle_new_client_fd_and_unlock()`:
```c
fd = _dbus_accept (listen_fd);
if (!_dbus_socket_is_valid (fd))
goto out;
if (do_check_nonce(fd, &nonce, NULL) != TRUE) {
_dbus_verbose ("nonce check failed. Closing socket.\n");
_dbus_close_socket (&fd, NULL);
goto out;
}
...
while (nleft)
{
int saved_errno;
n = _dbus_read_socket (fd, &p, nleft);
saved_errno = _dbus_save_socket_errno ();
if (n == -1 && _dbus_get_is_errno_eintr (saved_errno))
;
else if (n == -1 && _dbus_get_is_errno_eagain_or_ewouldblock  
(saved_errno))
_dbus_sleep_milliseconds (100);
...
if (!_dbus_set_socket_nonblocking (client_fd, NULL))
{
SERVER_UNLOCK (server);
return TRUE;
}
```
Because `do_check_nonce()` retries on `EAGAIN` with sleeps and has no  
overall deadline, a client that connects and sends no nonce bytes, or  
trickles fewer than 16 bytes, can keep this pre-authentication path  
occupied indefinitely. This can delay or stall additional connections to  
the same `nonce-tcp` listener. The available evidence supports an  
availability issue; it does not establish confidentiality, integrity, or  
code execution impact.
Steps to reproduce:
1. Start a daemon from this package so that it listens on a `nonce-tcp`  
address. A loopback listener is sufficient for reproduction.
2. Open attacker connection A to the `nonce-tcp` port.
3. Send no nonce bytes, or send fewer than 16 bytes very slowly, and keep A  
open.
4. Open additional valid or invalid client connections to the same listener.
5. Observe that acceptance or processing of subsequent connections is  
delayed or stalled while A remains open.
Mitigation: Disable `nonce-tcp` listeners where they are not required. If  
the transport must remain enabled, restrict reachability to trusted local  
clients and avoid exposing it beyond loopback until the nonce read path is  
hardened with timeout or nonblocking behavior.
Proposed Fix: Bound the time spent in the pre-authentication nonce read and  
make the accepted socket nonblocking before nonce verification so one  
client cannot keep the accept path occupied indefinitely.
```diff
diff --git a/dbus/dbus-nonce.c b/dbus/dbus-nonce.c
@@
+/* Bound time spent in nonce pre-auth read to avoid stalling accept path */
+#define NONCE_READ_TIMEOUT_MS 1000
+
static dbus_bool_t
do_check_nonce (DBusSocket fd, const DBusString *nonce, DBusError *error)
{
@@
nleft = 16;
+  int waited_ms = 0;
@@
while (nleft)
{
int saved_errno;
@@
else if (n == -1 && _dbus_get_is_errno_eagain_or_ewouldblock  
(saved_errno))
       _dbus_sleep_milliseconds (100);
+        {
+          if (waited_ms >= NONCE_READ_TIMEOUT_MS)
+            {
+              dbus_set_error (error, DBUS_ERROR_TIMEOUT,
+                              "Timed out while reading nonce");
+              _dbus_string_free (&p);
+              _dbus_string_free (&buffer);
+              return FALSE;
+            }
+          _dbus_sleep_milliseconds (10);
+          waited_ms += 10;
+        }
@@
  DBusSocket
  _dbus_accept_with_noncefile (DBusSocket listen_fd, const DBusNonceFile  
*noncefile)
  {
@@
    fd = _dbus_accept (listen_fd);
    if (!_dbus_socket_is_valid (fd))
      goto out;
+
+  if (!_dbus_set_socket_nonblocking (fd, NULL))
+    {
+      _dbus_close_socket (&fd, NULL);
+      goto out;
+    }
```


------
This report was generated using AI technology. Always review AI-generated  
content prior to use