PT-2022-5137 · D-Bus+10 · D-Bus+10
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
D-Bus versions 1.12.24 and earlier, 1.13.x, 1.14.x before 1.14.4, and 1.15.x before 1.15.2
Description
An issue was discovered in D-Bus where an authenticated attacker can cause dbus-daemon and other programs that use libdbus to crash when receiving a message with an array length inconsistent with the size of the element type. This is related to a boundary error caused by an invalid array of fixed-length elements, where the array length is not a multiple of the element length. The exploitation of this issue can allow a remote attacker to cause a denial of service.
Recommendations
For D-Bus versions 1.12.24 and earlier, update to version 1.12.24 or later.
For D-Bus version 1.13.x, update to version 1.14.4 or later.
For D-Bus versions 1.14.x before 1.14.4, update to version 1.14.4 or later.
For D-Bus versions 1.15.x before 1.15.2, update to version 1.15.2 or later.
Exploit
Fix
DoS
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
D-Bus
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu