Red Hat Bugzilla – Bug 1186775
CVE-2015-0245 dbus: denial of service in dbus systemd activation
Last modified: 2016-06-13 06:40:59 EDT
Tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=88811 Versions affected: dbus >= 1.4.0 Type of vulnerability: CWE-285 Improper Authorization Exploitable by: local users Impact: denial of service Reporter: Simon McVittie, Collabora Ltd. D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an asynchronous inter-process communication system, commonly used for system services or within a desktop session on Linux and other operating systems. dbus-daemon can "activate" (auto-start) D-Bus services on-demand when it receives a message addressed to them. In versions >= 1.4.0 of dbus, it can do this by using a D-Bus signal to ask systemd to carry out the actual service start. systemd sends back an ActivationFailure D-Bus signal if the activation fails. However, when it receives these signals, dbus-daemon does not verify that the signal actually came from systemd. A malicious local user could send repeated ActivationFailure signals in the hope that it would "win the race" with the genuine signal, causing D-Bus to send back an error to the client that requested activation. Mitigation: the system service is not actually prevented from starting or claiming its well-known bus name, and after it has done so, subsequent clients can communicate with it as usual.
This is now public: http://seclists.org/oss-sec/2015/q1/480
Analysis ======== In the code shipped in affected version of dbus it fails to check if a non-systemd process makes dbus-daemon think systemd failed to activate a system service, resulting in an error reply back to the requester, utilizing this attack vector malicious user can send multiple service failure messages resulting local DOS for the user trying to start any service. Attacker can only DOS local user and there is no possibility of arbitrary code execution hence the impact of this vulnerability very low.
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.