CVE-2023-34969: Medium severity D-bus Project D-bus vulnerability
An assertion failure in dbus-daemon when a privileged Monitoring connection (dbus-monitor, busctl monitor, gdbus monitor or similar) is active, and a message from the bus driver cannot be delivered to a client connection due to <deny> rules or outgoing message quota. This is a denial of service if triggered maliciously by a local attacker
In other words, if a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances.
Vulnerable versions:
1.15.x before 1.15.6 1.14.x before 1.14.8 1.12.x before 1.12.28 most end-of-life versions since 1.9.x
Fixed versions:
all since 1.15.6 1.14.x since 1.14.8 1.12.x since 1.12.28
Not vulnerable: end-of-life versions 1.8.x or older do not contain the affected code path.
https://gitlab.freedesktop.org/dbus/dbus/-/issues/457 https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1908636.html
Other sources
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
— Ubuntu
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dbusto a version that resolves this vulnerability.Fixed in 1.10.6-1ubuntu3.6+ - Upgrade
Upgrade
ubuntu/dbusto a version that resolves this vulnerability.Fixed in 1.12.28Fixed in 1.14.8Fixed in 1.15.6 - Upgrade
Upgrade
debian/dbusto a version that resolves this vulnerability.Fixed in 1.12.28-0+deb10u1Fixed in 1.12.28-0+deb11u1Fixed in 1.14.10-1~deb12u1Fixed in 1.14.10-4 - Upgrade
Upgrade
redhat/dbusto a version that resolves this vulnerability.Fixed in 1.15.6 - Upgrade
Upgrade
redhat/dbusto a version that resolves this vulnerability.Fixed in 1.14.8 - Upgrade
Upgrade
redhat/dbusto a version that resolves this vulnerability.Fixed in 1.12.28 - Upgrade
Upgrade
D-Bus (dbus-daemon)to a version that resolves this vulnerability.Fixed in 1.12.28 - Upgrade
Upgrade
D-Bus (dbus-daemon)to a version that resolves this vulnerability.Fixed in 1.14.8 - Upgrade
Upgrade
D-Bus (dbus-daemon)to a version that resolves this vulnerability.Fixed in 1.15.6
Event History
Frequently Asked Questions
What is CVE-2023-34969?
CVE-2023-34969 is a vulnerability in D-Bus that allows unprivileged users to crash dbus-daemon when a privileged user with control over the dbus-daemon is monitoring message bus traffic.
How does CVE-2023-34969 affect D-Bus?
CVE-2023-34969 affects D-Bus versions prior to 1.15.6, 1.14.8, and 1.12.28 on Red Hat systems, and versions prior to 1.10.6-1ubuntu3.6+ on Ubuntu systems.
What is the severity of CVE-2023-34969?
CVE-2023-34969 has a severity rating of medium.
How can I fix CVE-2023-34969?
To fix CVE-2023-34969, update D-Bus to version 1.15.6 or the recommended versions specific to your operating system.
Where can I find more information about CVE-2023-34969?
You can find more information about CVE-2023-34969 on the MITRE CVE website, Ubuntu Security Notices, and the NIST NVD website.