CVE-2020-16127: GHSL-2020-187: Denial of Service (DoS) in Ubuntu accountsservice - CVE-2020-16126 - CVE-2020-16127
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pamenvironment files, allowing an infinite loop if /dev/zero is symlinked to this location.
Other sources
The accountsservice daemon drops privileges to perform certain operations. For example while performing the org.freedesktop.Accounts.User.SetLanguage D-Bus method, which can be triggered by an unprivileged user, accounts-daemon temporarily drops privileges to the same UID as the user, to avoid being tricked into opening a file which the unprivileged user should not be able to access. Unfortunately, by changing its RUID it has given the user permission to send it signals. This means that the unprivileged user can send accounts-daemon a SIGSTOP signal, which stops the process and causes a denial of service.
— GitHub Security Lab
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2020-16127.
What is the severity of CVE-2020-16127?
CVE-2020-16127 has a severity keyword of 'medium' and a severity value of 5.5.
What software is affected by CVE-2020-16127?
The affected software is Freedesktop Accountsservice versions before 0.6.55-0ubuntu13.2.
How can the vulnerability CVE-2020-16127 be exploited?
The vulnerability can be exploited by creating a symlink to /dev/zero in the user-controlled ~/.pam_environment file, causing the program to enter an infinite loop.
Is there a fix for CVE-2020-16127?
Yes, the fix for CVE-2020-16127 is available in version 0.6.55-0ubuntu13.2 of Accountsservice.