Simon Mcvittie

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply serial != 0 and aborts the daemon.

O problema está relacionado a uma condição de corrida no binário snap-confine do utilitário snapd, que pode ser explorada para obter privilégios de root através da execução de código arbitrário. Isso pode ser feito por um invasor local que monte por ligação (bind-mount) seu próprio conteúdo dentro do namespace de montagem privado do snap, fazendo com que o snap-confine execute o código e resultando em escalonamento de privilégios.

**Nome do software vulnerável e versões afetadas: Versões do Flatpak 0.11.4 a 1.8.4 Versões do Flatpak 1.9.0 a 1.9.3 Descrição: Foi descoberto um bug no serviço `flatpak-portal` que pode permitir que aplicativos em sandbox executem código arbitrário no sistema host. O serviço D-Bus do portal Flatpak (`flatpak-portal`, também conhecido pelo nome de serviço D-Bus `org.freedesktop.portal.Flatpak`) permite que aplicativos em uma sandbox Flatpak iniciem seus próprios subprocessos em uma nova instância de sandbox. Nas versões vulneráveis, o serviço do portal Flatpak passa variáveis de ambiente especificadas pelo chamador para processos fora da sandbox no sistema host e, em particular, para o comando `flatpak run`, usado para iniciar a nova instância da sandbox. Um aplicativo Flatpak malicioso ou comprometido poderia definir variáveis de ambiente confiáveis para o comando `flatpak run` e usá-las para executar código arbitrário que não esteja na sandbox. Recomendações: Para as versões 0.11.4 a 1.8.4, atualize para a versão 1.8.5 ou posterior. Para as versões 1.9.0 a 1.9.3, atualize para a versão 1.9.4 ou posterior. Como solução alternativa temporária, considere impedir que o serviço `flatpak-portal` seja iniciado, mas essa medida impedirá que muitos aplicativos Flatpak funcionem corretamente.

The issue is related to errors in the authorization procedure of the GVFS subsystem in the GNOME desktop environment for Linux operating systems. A local attacker could connect to the D-Bus server socket and issue D-Bus method calls, potentially allowing them to exploit the vulnerability. The server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.

The issue is related to incorrect permission handling in the Glib library, specifically in the functions `g file make directory with parents` and `g file replace contents`. This can allow a remote attacker to elevate their privileges and gain access to files. The keyfile settings backend in GNOME GLib creates directories and files with improper permission restrictions, using 0777 permissions for directories and default file permissions for files.

The issue is related to errors in handling file descriptors in the Flatpak application and environment management tool. Exploitation of this issue may allow an attacker to modify arbitrary executable files on the host side by running the `apply extra` script. The vulnerability exposes /proc in the apply extra script sandbox, which enables attackers to modify a host-side executable file.

A cross-site scripting (XSS) issue exists, potentially allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message in the cgierror function in CGI.pm.

The issue allows an attacker to execute malicious code by supplying a .pyc file, potentially tricking the AddTemplate() D-Bus method call or the DBusTestCase.spawn server template() method into executing the malicious code.

The default D-Bus access control rule in Midgard2 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

The issue is caused by an off-by-one error when running on a 64-bit system and the max message unix fds limit is set to an odd number. This allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure. The vulnerability can be exploited to compromise the confidentiality, integrity, and availability of protected information.

The issue is caused by synchronization errors when using a shared resource in the D-Bus interprocess communication system. Exploitation of this issue may allow an attacker to cause a denial of service due to the lack of functionality to check the source of the `ActivationFailure` signal. Local users can leverage a race condition involving sending an `ActivationFailure` signal before systemd responds, resulting in an activation failure error.

The issue arises from inadequate verification of X.509 certificates. Specifically, it does not check (1) if the issuer is a trusted Certificate Authority (CA), (2) if the server hostname matches a domain name in the subject's Common Name (CN), or (3) the expiration date of the certificate. This oversight allows man-in-the-middle attackers to spoof SSL servers by using any valid certificate.

The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.

The issue allows remote attackers to cause a denial of service, resulting in a divide-by-zero error and a kernel panic, through IGMP packets. This is due to the `igmp heard query` function in `net/ipv4/igmp.c`.

The issue is related to the lack of input sanitization in the Net::Ping::External extension for Perl, specifically with regards to shell metacharacters in arguments such as invalid hostnames. This allows for shell command injection and arbitrary command execution if untrusted input is used. The vulnerability can be exploited by a remote attacker to execute arbitrary commands using shell metacharacters.