CVE-2020-16126: GHSL-2020-187: Denial of Service (DoS) in Ubuntu accountsservice - CVE-2020-16126 - CVE-2020-16127
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.
Other sources
The accountsservice daemon drops privileges to perform certain operations. For example while performing the org.freedesktop.Accounts.User.SetLanguage D-Bus method, which can be triggered by an unprivileged user, accounts-daemon temporarily drops privileges to the same UID as the user, to avoid being tricked into opening a file which the unprivileged user should not be able to access. Unfortunately, by changing its RUID it has given the user permission to send it signals. This means that the unprivileged user can send accounts-daemon a SIGSTOP signal, which stops the process and causes a denial of service.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-16126?
CVE-2020-16126 is an Ubuntu-specific modification to AccountsService that improperly dropped the ruid, allowing untrusted users to send signals to AccountService, causing a denial-of-service (DOS) vulnerability.
How does CVE-2020-16126 affect Ubuntu?
CVE-2020-16126 affects certain versions of Ubuntu's AccountsService (before 0.6.55-0ubuntu13.2) by allowing untrusted users to stop AccountsService from handling D-Bus messages in a timely fashion.
What is the severity of CVE-2020-16126?
CVE-2020-16126 has a severity rating of low, with a severity score of 3.3.
How can I fix CVE-2020-16126?
To fix CVE-2020-16126, it is recommended to update your Ubuntu system to version 0.6.55-0ubuntu13.2 or later, which addresses the vulnerability.
Where can I find more information about CVE-2020-16126?
More information about CVE-2020-16126 can be found in the advisory published by the GitHub Security Lab: [link](https://securitylab.github.com/advisories/GHSL-2020-187-accountsservice-drop-privs-DOS).