Date: Mon, 09 Feb 2015 15:22:03 +0000 From: Simon McVittie <simon.mcvittie@...labora.co.uk> To: oss-security@...ts.openwall.com CC: "dbus@...ts.freedesktop.org" <dbus@...ts.freedesktop.org> Subject: CVE-2015-0245: denial of service in dbus >= 1.4 systemd activation Bug tracked as: CVE-2015-0245 Bug tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=88811 Versions affected: dbus >= 1.4.0 Versions fixed: >= 1.9.10, 1.8.x >= 1.8.16, 1.6.x >= 1.6.30 Type of vulnerability: CWE-285 Improper Authorization Exploitable by: local users Impact: denial of service Reporter: Simon McVittie, Collabora Ltd. D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an asynchronous inter-process communication system, commonly used for system services or within a desktop session on Linux and other operating systems. dbus-daemon can "activate" (auto-start) D-Bus services on-demand when it receives a message addressed to them. In versions >= 1.4.0 of dbus, it can do this by using a D-Bus signal to ask systemd to carry out the actual service start. systemd sends back an ActivationFailure D-Bus signal if the activation fails. However, when it receives these signals, dbus-daemon does not verify that the signal actually came from systemd. A malicious local user could send repeated ActivationFailure signals in the hope that it would "win the race" with the genuine signal, causing D-Bus to send back an error to the client that requested activation. Mitigation: the system service is not actually prevented from starting or claiming its well-known bus name, and after it has done so, subsequent clients can communicate with it as usual. The recommended fix for stable distributions is to alter system.conf similar to the attached patch (commit link below), or upgrade to version 1.8.16 or 1.6.30. This restricts the attack to uid 0, making it a non-issue in practice. http://cgit.freedesktop.org/dbus/dbus/commit/?id=6dbd09fedc396c53b25ea73c6c8a278beca349c7 The full solution involves additional code changes and has only been made in the 1.9 development branch so far, but is easy to backport to 1.8 if required (e.g. for environments where uid 0 is not all-powerful due to use of LSMs). It requires two additional commits: http://cgit.freedesktop.org/dbus/dbus/commit/?id=aaea59916398d1c590490edb0471a01bcf20e6d7 http://cgit.freedesktop.org/dbus/dbus/commit/?id=03c5e161752fe1ff4925955800ca9c78d09a6e0c Regards, S -- Simon McVittie, Collabora Ltd. on behalf of the D-Bus maintainers From b07a95b457a5e72bae525c4f3e707544cd8a99b3 Mon Sep 17 00:00:00 2001 From: Simon McVittie <simon.mcvittie@...labora.co.uk> Date: Mon, 26 Jan 2015 20:09:56 +0000 Subject: [PATCH] CVE-2015-0245: prevent forged ActivationFailure from non-root processes Without either this rule or better checking in dbus-daemon, non-systemd processes can make dbus-daemon think systemd failed to activate a system service, resulting in an error reply back to the requester. This is redundant with the fix in the C code (which I consider to be the real solution), but is likely to be easier to backport. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=88811 Reviewed-by: Alban Crequy Reviewed-by: David King Reviewed-by: Philip Withnall --- bus/system.conf.in | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/bus/system.conf.in b/bus/system.conf.in index 92f4cc4..851b9e6 100644 --- a/bus/system.conf.in +++ b/bus/system.conf.in @@ -68,6 +68,14 @@ <deny send_destination="org.freedesktop.DBus" send_interface="org.freedesktop.DBus" send_member="UpdateActivationEnvironment"/> + <deny send_destination="org.freedesktop.DBus" + send_interface="org.freedesktop.systemd1.Activator"/> + </policy> + + <!-- Only systemd, which runs as root, may report activation failures. --> + <policy user="root"> + <allow send_destination="org.freedesktop.DBus" + send_interface="org.freedesktop.systemd1.Activator"/> </policy> <!-- Config files are placed here that among other things, punch -- 2.1.4 [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ