CVE-2020-35512: Use After Free
A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors
Other sources
On Unix, avoid a use-after-free if two usernames have the same numeric uid. In older versions this could lead to a crash (denial of service) or other undefined behaviour, possibly including incorrect authorization decisions if <policy group=...> is used. Like Unix filesystems, D-Bus' model of identity cannot distinguish between users of different names with the same numeric uid, so this configuration is not advisable on systems where D-Bus will be used.
Reference:
https://bugs.gentoo.org/755392
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-35512?
CVE-2020-35512 is a use-after-free vulnerability found in D-Bus that allows an attacker to execute arbitrary code or cause a denial of service.
What is the severity of CVE-2020-35512?
The severity of CVE-2020-35512 is high with a CVSS score of 7.8.
Which versions of D-Bus are affected by CVE-2020-35512?
D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 are affected by CVE-2020-35512.
How can an attacker exploit CVE-2020-35512?
An attacker can exploit CVE-2020-35512 by leveraging the use-after-free flaw to execute arbitrary code or perform a denial of service attack.
What is the recommended remedy for CVE-2020-35512?
The recommended remedy for CVE-2020-35512 is to update D-Bus to version 1.12.20 or higher, or 1.10.32 for older branches.