Bug 1186775 (CVE-2015-0245) - CVE-2015-0245 dbus: denial of service in dbus systemd activation
Summary: CVE-2015-0245 dbus: denial of service in dbus systemd activation
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2015-0245
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1186776
TreeView+ depends on / blocked
 
Reported: 2015-01-28 14:16 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 05:42 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-06-10 21:02:53 UTC
Embargoed:


Attachments (Terms of Use)

Description Vasyl Kaigorodov 2015-01-28 14:16:14 UTC
Tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=88811
Versions affected: dbus >= 1.4.0
Type of vulnerability: CWE-285 Improper Authorization
Exploitable by: local users
Impact: denial of service
Reporter: Simon McVittie, Collabora Ltd.

D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an asynchronous inter-process communication system, commonly used for system services or within a desktop session on Linux and other operating systems.

dbus-daemon can "activate" (auto-start) D-Bus services on-demand when it receives a message addressed to them. In versions >= 1.4.0 of dbus, it can do this by using a D-Bus signal to ask systemd to carry out the actual service start.

systemd sends back an ActivationFailure D-Bus signal if the activation fails. However, when it receives these signals, dbus-daemon does not verify that the signal actually came from systemd. A malicious local user could send repeated ActivationFailure signals in the hope that it would "win the race" with the genuine signal, causing D-Bus to send back an error to the client that requested activation.

Mitigation: the system service is not actually prevented from starting or claiming its well-known bus name, and after it has done so, subsequent clients can communicate with it as usual.

Comment 1 Kurt Seifried 2015-02-26 17:54:06 UTC
This is now public: http://seclists.org/oss-sec/2015/q1/480

Comment 2 Siddharth Sharma 2015-05-04 08:00:20 UTC
Analysis
========

In the code shipped in affected version of dbus it fails to check if a non-systemd process makes dbus-daemon think systemd failed to activate a system service, resulting in an error reply back to the requester, utilizing this attack vector malicious user can send multiple service failure messages resulting local DOS for the user trying to start any service. Attacker can only DOS local user and there is no possibility of arbitrary code execution hence the impact of this vulnerability very low.

Comment 4 Vincent Danen 2016-06-10 21:02:53 UTC
Statement:

Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.