CVE-2020-35512

D-Bus is a message bus system, a simple way for applications to talk to one another. In addition to interprocess communication, D-Bus helps coordinate process lifecycle; it makes it simple and reliable to code a "single instance" application or daemon, and to launch applications and daemons on demand when their services are needed.

Security Fix(es):

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors(CVE-2020-35512)

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

• SECURITY UPDATE: Use-after-free in access control-related hash tables
  • debian/patches/CVE-2020-35512.patch: use reference counting for DBusUserInfo and DBusGroupInfo structures.
  • CVE-2020-35512
• SECURITY UPDATE: Crash or incorrect parsing a signature with wrongly nested '()' and '{}'
  • debian/patches/CVE-2022-42010.patch: add extra checking for brackets.
  • CVE-2022-42010
• SECURITY UPDATE: Out-of-bounds accesses during processing of arrays made up of an integer number of items
  • debian/patches/CVE-2022-42011.patch: validate length of arrays of fixed-length items.
  • CVE-2022-42011
• SECURITY UPDATE: Crash when message type and the pointer into its contents goes out of sync
  • debian/patches/CVE-2022-42012.patch: byte-swap Unix fd indexes if needed.
  • CVE-2022-42012

This update for dbus-1 fixes the following issues:

• CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for dbus-1 fixes the following issues:

• CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)

This update for dbus-1 fixes the following issues:

• CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)

This update for dbus-1 fixes the following issues:

• CVE-2020-35512: Fixed a use-after-free or potential undefined behaviour caused by shared UID's (bsc#1187105)

This update for dbus-1 fixes the following issues:

• CVE-2020-35512: users with the same numeric UID could lead to use-after-free and undefined behaviour (bsc#1187105)
• CVE-2020-12049: truncated messages lead to resource exhaustion (bsc#1172505)

This update for dbus-1 fixes the following issues:

• CVE-2020-35512: Fixed a bug where users with the same numeric UID could lead to use-after-free and undefined behaviour. (bsc#1187105)
• CVE-2020-12049: Fixed a bug where a truncated messages lead to resource exhaustion. (bsc#1172505)

This update for dbus-1 fixes the following issues:

• CVE-2020-35512: Fixed a memory safety issue which affected systems with users with the same numeric UID (bsc#1187105).

Daniel Onaca discovered that DBus contained a use-after-free vulnerability, caused by the incorrect handling of usernames sharing the same UID. An attacker could possibly use this issue to cause DBus to crash, resulting in a denial of service.

USN-5244-1 fixed a vulnerability in DBus. This update provides the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

Daniel Onaca discovered that DBus contained a use-after-free vulnerability, caused by the incorrect handling of usernames sharing the same UID. An attacker could possibly use this issue to cause DBus to crash, resulting in a denial of service.