Moderate: dbus security update
Summary
ALSA-2023:0335: Moderate: dbus security update. Affects dbus versions < 1:1.12.20-7.el9_1. Fixed in 1:1.12.20-7.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
D-Bus is a system for sending messages between applications. It serves as both the system-wide message bus service and a per-user-login-session messaging facility. D-Bus is widely used in various Linux distributions and plays a crucial role in inter-process communication.
Vulnerability Detail
The dbus-daemon component of D-Bus is susceptible to multiple security vulnerabilities:
-
CVE-2022-42010: dbus-daemon crashes when receiving a message with incorrectly nested parentheses and curly brackets. An attacker can exploit this flaw to crash the daemon, potentially leading to a denial-of-service condition.
-
CVE-2022-42011: dbus-daemon can be crashed by messages with an array length inconsistent with the element type. By sending specially crafted messages, an attacker can trigger a crash in the daemon, potentially resulting in a denial-of-service situation.
-
CVE-2022-42012: The
_dbus_marshal_byteswapfunction in dbus-daemon does not process file descriptors correctly in messages with "foreign" endianness. This vulnerability can be exploited by an attacker to cause a crash in the daemon, potentially leading to a denial-of-service scenario.
How To Fix
Minimum fixed version
1:1.12.20-7.el9_1
This is the first release that contains the fix.
sudo dnf update dbusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
D-Bus is prone to multiple security vulnerabilities that can be exploited to crash the dbus-daemon. It is crucial to update the dbus package to the recommended version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for dbus →
FAQ
D-Bus is a system for inter-process communication, allowing applications to communicate with each other and exchange messages.
These vulnerabilities can be exploited by an attacker to crash the dbus-daemon, potentially leading to a denial-of-service condition.
Yes, all versions of dbus prior to 1.12.20-7.el9_1 are affected by these vulnerabilities.
The CVSS scores for these vulnerabilities have not been provided in the available information.
You can find more information about these vulnerabilities in the CVE pages listed in the References section of the original advisory.
Related vulnerabilities
Recent vulnerabilities recorded for dbus.
