CVE-2020-12049

NameCVE-2020-12049
DescriptionAn issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-2235-1
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
dbus (PTS)stretch1.10.32-0+deb9u1fixed
stretch (security)1.10.28-0+deb9u1vulnerable
buster1.12.20-0+deb10u1fixed
bullseye, sid1.12.20-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
dbussourcejessie1.8.22-0+deb8u3DLA-2235-1
dbussourcestretch1.10.32-0+deb9u1
dbussourcebuster1.12.20-0+deb10u1
dbussource(unstable)1.12.18-1

Notes

https://www.openwall.com/lists/oss-security/2020/06/04/3
https://gitlab.freedesktop.org/dbus/dbus/-/issues/294
Fixed by: https://gitlab.freedesktop.org/dbus/dbus/-/commit/272d484283883fa9ff95b69d924fff6cd34842f5
Test: https://gitlab.freedesktop.org/dbus/dbus/-/commit/8bc1381819e5a845331650bfa28dacf6d2ac1748

Search for package or bug name: Reporting problems