PT-2022-5134 · D-Bus+10 · D-Bus+10
Evgeny Vereshchagin
·
Published
2022-10-05
·
Updated
2025-01-28
·
CVE-2022-42012
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
D-Bus versions 1.12.24 and earlier, 1.13.x, 1.14.x before 1.14.4, and 1.15.x before 1.15.2
Description
An issue was discovered in D-Bus that allows an authenticated attacker to cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. The vulnerability is related to a use-after-free error caused by a message with out-of-band Unix file descriptors and a non-native byte order. This can lead to a denial-of-service.
Recommendations
For D-Bus versions 1.12.24 and earlier, update to version 1.12.24 or later.
For D-Bus version 1.13.x, update to version 1.14.4 or later.
For D-Bus version 1.14.x before 1.14.4, update to version 1.14.4 or later.
For D-Bus version 1.15.x before 1.15.2, update to version 1.15.2 or later.
As a temporary workaround, consider restricting access to the
dbus-daemon to minimize the risk of exploitation.Exploit
Fix
Improper Validation of Array Index
Use After Free
Assertion Failure
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
D-Bus
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu