Memory leak in dbus - CVE-2020-12049

Vulnerability identifier: #VU29105

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-12049

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak in libdbus when a message exceeds the per-message file descriptor limit. A local user with access to the D-Bus system bus or another system service's private AF_UNIX socket can make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

dbus
Gentoo Linux
Arch Linux
SUSE MicroOS
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Server
SUSE OpenStack Cloud
Red Hat Enterprise Linux for x86_64
HPE Helion Openstack
Red Hat Enterprise Linux for ARM 64
SUSE OpenStack Cloud Crowbar
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
openEuler
BIG-IP
dbus (Alpine package)
dbus (Red Hat package)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
dbus-1
dbus-1-debugsource
dbus-1-x11
dbus-1-x11-debuginfo
dbus-1-x11-debugsource
libdbus-1-3
libdbus-1-3-32bit
libdbus-1-3-debuginfo-32bit
libdbus-1-3-debuginfo
dbus-1-debuginfo
dbus-1-debuginfo-32bit
dbus-1-devel-doc
dbus-1-devel
libdbus-1-3-32bit-debuginfo
dbus-1-32bit-debuginfo
dbus
dbus-common
dbus-daemon
dbus-debuginfo
dbus-debugsource
dbus-devel
dbus-help
dbus-libs
dbus-tools
dbus-x11
Cloud Pak for Security (CP4S)
Quay
BIG-IQ Centralized Management
Data Computing Appliance (DCA)
Dell EMC VxRail Appliance

Install updates from vendor's website.

dbus - addressed in versions 1.10.30, 1.12.18, 1.13.16
dbus (Alpine package) - update to 1.10.28-r1
Cloud Pak for Security (CP4S) - update to 1.8.0.0
dbus (Red Hat package) - addressed in versions 1.10.24-14.el7_8, 1.12.8-8.el8_0, 1.12.8-10.el8_1, 1.12.8-10.el8_2
Quay - update to 3.3.1
dbus-1 - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.2
dbus-1-debugsource - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.2
dbus-1-x11 - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.1
dbus-1-x11-debuginfo - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.1
dbus-1-x11-debugsource - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.1
libdbus-1-3 - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.2
libdbus-1-3-32bit - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.2
libdbus-1-3-debuginfo-32bit - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2
libdbus-1-3-debuginfo - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.2
dbus-1-debuginfo - addressed in versions 1.8.22-29.21.1, 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.2
dbus-1-debuginfo-32bit - update to 1.8.22-29.21.1
dbus-1-devel-doc - update to 1.8.22-35.2
dbus-1-devel - addressed in versions 1.8.22-35.2, 1.12.2-3.16.1, 1.12.2-8.11.2
libdbus-1-3-32bit-debuginfo - addressed in versions 1.12.2-3.16.1, 1.12.2-8.11.2
dbus-1-32bit-debuginfo - addressed in versions 1.12.2-3.16.1, 1.12.2-8.11.2
dbus - update to 1.12.16-15
dbus-common - update to 1.12.16-15
dbus-daemon - update to 1.12.16-15
dbus-debuginfo - update to 1.12.16-15
dbus-debugsource - update to 1.12.16-15
dbus-devel - update to 1.12.16-15
dbus-help - update to 1.12.16-15
dbus-libs - update to 1.12.16-15
dbus-tools - update to 1.12.16-15
dbus-x11 - update to 1.12.16-15
Data Computing Appliance (DCA) - update to 4.3.0.0
Dell EMC VxRail Appliance - update to 4.7.533

• http://www.openwall.com/lists/oss-security/2020/06/04/3
• https://gitlab.freedesktop.org/dbus/dbus/-/issues/294
• https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.10.30
• https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.12.18
• https://gitlab.freedesktop.org/dbus/dbus/-/tags/dbus-1.13.16

• Denial of service in Freedesktop dbus
• Red Hat Enterprise Linux 7 update for dbus
• Red Hat Enterprise Linux 8 update for dbus
• Red Hat Enterprise Linux 8 update for dbus
• Gentoo update for D-Bus
• Red Hat Enterprise Linux 8 update for dbus
• Multiple vulnerabilities in Red Hat Quay
• Memory leak in dbus (Alpine package)
• Arch Linux update for dbus
• Memory leak in D-Bus component in F5 BIG-IP products
• SUSE update for dbus-1
• SUSE update for dbus-1
• SUSE update for dbus-1
• SUSE update for dbus-1
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• openEuler 20.03 LTS update for dbus-1.12.16-13