Use-after-free in dbus - CVE-2022-42012

Vulnerability identifier: #VU67971

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-42012

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error caused by a message in non-native endianness with out-of-band Unix file descriptors. A local user can trigger a use-after-free error and execute arbitrary code with elevated privileges.

dbus
Debian Linux
Gentoo Linux
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
openSUSE Leap Micro
SUSE Enterprise Storage
Oracle Linux
SUSE Linux Enterprise Storage
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
Oracle Solaris
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
Fedora
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
IBM Cloud Pak for Watson AIOps
cflinuxfs3
EMC Cloud Tiering Appliance
Robotic Process Automation for Cloud Pak
Submariner
Migration Toolkit for Runtimes
Red Hat Advanced Cluster Management for Kubernetes
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Red Hat Migration Toolkit for Applications
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Power Hardware Management Console (HMC)
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Dell EMC Container Storage Modules
Red Hat OpenShift GitOps
OpenShift Service Mesh
Red Hat OpenShift Serverless
OpenShift Data Foundation (formerly OpenShift Container Storage)
RecoverPoint for Virtual Machines
Cloud Pak for Security (CP4S)
LANTIME Operating System Firmware (LTOS)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
dbus (Ubuntu package)
libdbus-1-3 (Ubuntu package)
dbus
libdbus-1-3
libdbus-1-3-debuginfo-32bit
libdbus-1-3-debuginfo
libdbus-1-3-32bit
dbus-1-x11-debugsource
dbus-1-x11-debuginfo
dbus-1-x11
dbus-1-debugsource
dbus-1-debuginfo-32bit
dbus-1-debuginfo
dbus-1
dbus-1-devel
dbus-1-devel-doc
libdbus-1-3-32bit-debuginfo
dbus-1-32bit-debuginfo
dbus-1-devel-32bit
dbus (Red Hat package)
dbus-debuginfo
dbus-daemon
dbus-help
dbus-debugsource
dbus-common
dbus-libs
dbus-tools
dbus-x11
dbus-devel
dbus (Debian package)
sys-apps/dbus
Dell EMC NetWorker vProxy
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
Dell EMC VxRail Appliance
IBM DS8000 Hardware Management Console

Install updates from vendor's website.

dbus - addressed in versions 1.12.24, 1.14.4, 1.15.2
Submariner - update to 0.14.0
Migration Toolkit for Runtimes - update to 1.0.2
OpenShift API for Data Protection (OADP) - update to 1.1.2
Migration Toolkit for Containers - update to 1.7.7
Red Hat OpenShift GitOps - addressed in versions 1.5.9, 1.6.4, 1.7
OpenShift Service Mesh - addressed in versions 2.3.1, 2.3.2
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.6.4, 2.7.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.11.20, 4.11.45, 4.12.0, 4.13.0, 4.13.2
OpenShift Logging - update to 5.6.1
Red Hat Migration Toolkit for Applications - update to 6.0.1
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
LANTIME Operating System Firmware (LTOS) - addressed in versions 6.24.035, 7.06.008
dbus (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.12.2-1ubuntu1.4, 1.12.16-2ubuntu2.3, 1.12.20-2ubuntu4.1, 1.14.0-2ubuntu3
libdbus-1-3 (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 1.12.2-1ubuntu1.4, 1.12.16-2ubuntu2.3, 1.12.20-2ubuntu4.1, 1.14.0-2ubuntu3
cflinuxfs3 - update to 0.331.0
Dell EMC Container Storage Modules - update to 1.6.0
Netcool Operations Insight - update to 1.6.12
dbus - addressed in versions 1.6.12-14.31, 1.12.24-1
libdbus-1-3 - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
libdbus-1-3-debuginfo-32bit - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1
libdbus-1-3-debuginfo - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
libdbus-1-3-32bit - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-x11-debugsource - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-x11-debuginfo - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-x11 - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-debugsource - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-debuginfo-32bit - update to 1.8.22-29.24.1
dbus-1-debuginfo - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1 - addressed in versions 1.8.22-29.24.1, 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-devel - addressed in versions 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-devel-doc - addressed in versions 1.8.22-38.1, 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
Cloud Pak for Security (CP4S) - update to 1.10.12.0
libdbus-1-3-32bit-debuginfo - addressed in versions 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-32bit-debuginfo - addressed in versions 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus-1-devel-32bit - addressed in versions 1.12.2-150100.8.14.1, 1.12.2-150400.18.5.1
dbus (Red Hat package) - addressed in versions 1.12.8-18.el8_6.2, 1.12.8-23.el8_7.1, 1.12.20-5.el9_0.1, 1.12.20-7.el9_1
dbus-debuginfo - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-daemon - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-help - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-debugsource - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-common - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-libs - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-tools - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-x11 - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus-devel - addressed in versions 1.12.16-19, 1.12.16-20, 1.12.20-8
dbus (Debian package) - update to 1.12.24-0+deb11u1
dbus - addressed in versions 1.12.24-1.fc35, 1.14.4-1.fc36, 1.14.4-1.fc37
sys-apps/dbus - update to 1.14.4
Red Hat OpenShift Serverless - update to 1.27.0
Dell EMC NetWorker vProxy - update to 4.3.0-40
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.4
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.9.0.0
EMC ViPR SRM - update to 4.9.0.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
Dell EMC VxRail Appliance - update to 7.0.411
IBM Power Hardware Management Console (HMC) - addressed in versions 9.2.950.0 SP3, 10.1.1020.0 SP1, 10.2.1030.0
EMC Cloud Tiering Appliance - update to 13.1.0.2.29
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.3, 23.0.3
IBM DS8000 Hardware Management Console - update to 89.33.34.0

• https://seclists.org/oss-sec/2022/q4/7
• https://gitlab.freedesktop.org/dbus/dbus/-/commit/236f16e444e88a984cf12b09225e0f8efa6c5b44

• Multiple vulnerabilities in dbus
• Debian update for dbus
• Ubuntu update for dbus
• SUSE update for dbus-1
• SUSE update for dbus-1
• SUSE update for dbus-1
• Cloud Foundry Foundation cflinuxfs3 update for DBus
• SUSE update for dbus-1
• Red Hat Enterprise Linux 8.6 Extended Update Support update for dbus
• Red Hat Enterprise Linux 9.0 Extended Update Support update for dbus
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Red Hat Enterprise Linux 8 update for dbus
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Red Hat Enterprise Linux 9 update for dbus
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.5
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.7
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.6
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• Multiple vulnerabilities in Submariner
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Red Hat Advanced Cluster Management for Kubernetes 2.6 update for Submariner
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.1
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in Oracle Solaris
• Multiple vulnerabilities in Red Hat OpenShift Service Mesh 2.3
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Use-after-free in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Amazon Linux AMI update for dbus
• Multiple vulnerabilities in IBM Power Hardware Management Console (HMC)
• Gentoo update for D-Bus
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM DS8000 Hardware Management Console (HMC)
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Dell NetWorker vProxy
• Multiple vulnerabilities in Dell Container Storage Modules
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• openEuler 20.03 LTS SP1 update for dbus
• openEuler 22.03 LTS update for dbus
• openEuler 20.03 LTS SP3 update for dbus
• Multiple vulnerabilities in Netcool Operations Insight
• Amazon Linux AMI update for dbus
• Fedora 37 update for dbus
• Fedora 36 update for dbus
• Fedora 35 update for dbus
• Meinberg LANTIME firmware update for third-party components (January 2023)
• Dell RecoverPoint for Virtual Machines update for third-party components