SB2021080220 - SUSE update for dbus-1 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021080220

SB2021080220 - SUSE update for dbus-1

Published: August 2, 2021

Security Bulletin ID SB2021080220
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Memory leak (CVE-ID: CVE-2020-12049)

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak in libdbus when a message exceeds the per-message file descriptor limit. A local user with access to the D-Bus system bus or another system service's private AF_UNIX socket can make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.


2) Use-after-free (CVE-ID: CVE-2020-35512)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error if two usernames have the same numeric UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, which can result in crash.


Remediation

Install update from vendor's website.

References