CVE-2020-12049: GHSL-2020-057: dbus file descriptor leak (DoS) - CVE-2020-12049
An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AFUNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.
Other sources
D-Bus has a file descriptor leak, which can lead to denial of service when the dbus-daemon runs out of file descriptors. An unprivileged local attacker can use this to attack the system dbus-daemon, leading to denial of service for all users of the machine.
— GitHub Security Lab
D-Bus is vulnerable to a denial of service, caused by an error in dbusreadsocketwithunixfds. By sending specially crafted messages, a local attacker could exploit this vulnerability to cause the system dbus-daemon (dbus-daemon --system) to leak file descriptors.
— IBM
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-12049?
CVE-2020-12049 is a vulnerability in D-Bus that can be exploited to cause a denial of service.
How does CVE-2020-12049 impact D-Bus?
CVE-2020-12049 can result in a denial of service by leaking file descriptors when a message exceeds the per-message file descriptor limit.
What is the severity of CVE-2020-12049?
The severity of CVE-2020-12049 is medium, with a severity value of 5.5.
How can I fix CVE-2020-12049?
To fix CVE-2020-12049, update to the recommended versions of D-Bus provided by your operating system or package manager.
Where can I find more information about CVE-2020-12049?
You can find more information about CVE-2020-12049 in the references provided: [link 1](http://packetstormsecurity.com/files/172840/D-Bus-File-Descriptor-Leak-Denial-Of-Service.html), [link 2](http://www.openwall.com/lists/oss-security/2020/06/04/3), [link 3](https://gitlab.freedesktop.org/dbus/dbus/-/issues/294).