DBus File Descriptor Leak Vulnerability in dbus Package
Summary
ALPINE-CVE-2020-12049: An issue was discovered in dbus >= 1.3.0 before 1.12.18. Affects dbus versions < 1.12.16-r1. Fixed in 1.12.16-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dbus package is an inter-process communication (IPC) system that allows multiple programs to communicate with one another. It is widely used in Linux environments to facilitate communication between system services and applications. The package is designed to manage messages and signals between different processes, ensuring efficient data exchange. However, a vulnerability has been identified that allows local attackers to exploit the system bus, potentially leading to service denial for other clients.
Vulnerability Detail
An issue was discovered in dbus versions >= 1.3.0 and < 1.12.18, where the DBusServer in libdbus leaks file descriptors when a message exceeds the per-message file descriptor limit. This leak can be exploited by a local attacker who has access to the D-Bus system bus or another service's private AF_UNIX socket. By causing the system service to reach its file descriptor limit, the attacker can deny service to subsequent D-Bus clients, leading to potential disruptions in service and functionality.
How To Fix
Minimum fixed version
1.12.16-r1
This is the first release that contains the fix.
sudo apk add --upgrade dbusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the D-Bus system bus to trusted users only. This can help mitigate the risk of unauthorized access and potential exploitation of the vulnerability until a patch is applied.
Conclusion
The dbus package has a critical vulnerability that can be exploited by local attackers to cause denial of service. It is crucial to update to the patched versions of the dbus package to mitigate this risk. Additionally, implementing access restrictions can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for dbus →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
Local attackers with access to the D-Bus system bus or another service's private AF_UNIX socket can exploit this vulnerability.
Exploitation of this vulnerability can lead to denial of service for other D-Bus clients, disrupting normal operations.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for dbus.
