Red Hat Enterprise Linux 8.6 Extended Update Support update for dbus

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU78490

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-34969

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in the dbus-daemon when sending a reply message from the "bus driver". If a local privileged user (e.g. root) is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, another unprivileged user with the ability to connect to the same dbus-daemon can force the service to send an unreplyable message and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions: 8.6

Red Hat Enterprise Linux for ARM 64 - Extended Update Support: 8.6

Red Hat Enterprise Linux Server - TUS: 8.6

Red Hat Enterprise Linux for Power, little endian - Extended Update Support: 8.6

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support: 8.6

Red Hat Enterprise Linux Server - AUS: 8.6

Red Hat Enterprise Linux for x86_64 - Extended Update Support: 8.6

dbus (Red Hat package): before 1.12.8-18.el8_6.3

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux_server_\(for_ibm_power_le\)_-_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

External links

http://access.redhat.com/errata/RHSA-2023:5193

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?