CVE-2020-12049

Name of the Vulnerable Software and Affected Versions dbus versions 1.3.0 through 1.12.18

Description The issue is related to the incorrect handling of file descriptor limits in the D-Bus system, specifically in the dbus read socket with unix fds function of the dbus/dbus-sysdeps-unix.c component. This can lead to a denial of service when a local attacker with access to the D-Bus system bus or another system service's private AF UNIX socket sends a message that exceeds the per-message file descriptor limit, causing the system service to reach its file descriptor limit and deny service to subsequent D-Bus clients.

Recommendations For dbus versions 1.3.0 through 1.12.18, update to version 1.12.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the D-Bus system bus and private AF UNIX sockets to minimize the risk of exploitation.