Simon Mcvittie

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply serial != 0 and aborts the daemon.

The issue is related to a race condition in the snap-confine binary of the snapd utility, which can be exploited to gain root privileges by executing arbitrary code. This can be achieved by a local attacker bind-mounting their own contents inside the snap's private mount namespace, causing snap-confine to execute the code and resulting in privilege escalation.

Name of the Vulnerable Software and Affected Versions: Flatpak versions 0.11.4 through 1.8.4 Flatpak versions 1.9.0 through 1.9.3 Description: A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system. The Flatpak portal D-Bus service (`flatpak-portal`, also known by its D-Bus service name `org.freedesktop.portal.Flatpak`) allows apps in a Flatpak sandbox to launch their own subprocesses in a new sandbox instance. In vulnerable versions, the Flatpak portal service passes caller-specified environment variables to non-sandboxed processes on the host system, and in particular to the `flatpak run` command that is used to launch the new sandbox instance. A malicious or compromised Flatpak app could set environment variables that are trusted by the `flatpak run` command, and use them to execute arbitrary code that is not in a sandbox. Recommendations: For versions 0.11.4 through 1.8.4, update to version 1.8.5 or later. For versions 1.9.0 through 1.9.3, update to version 1.9.4 or later. As a temporary workaround, consider preventing the `flatpak-portal` service from starting, but this mitigation will prevent many Flatpak apps from working correctly.

The issue is related to errors in the authorization procedure of the GVFS subsystem in the GNOME desktop environment for Linux operating systems. A local attacker could connect to the D-Bus server socket and issue D-Bus method calls, potentially allowing them to exploit the vulnerability. The server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.

The issue is related to incorrect permission handling in the Glib library, specifically in the functions `g file make directory with parents` and `g file replace contents`. This can allow a remote attacker to elevate their privileges and gain access to files. The keyfile settings backend in GNOME GLib creates directories and files with improper permission restrictions, using 0777 permissions for directories and default file permissions for files.

The issue is related to errors in handling file descriptors in the Flatpak application and environment management tool. Exploitation of this issue may allow an attacker to modify arbitrary executable files on the host side by running the `apply extra` script. The vulnerability exposes /proc in the apply extra script sandbox, which enables attackers to modify a host-side executable file.

A cross-site scripting (XSS) issue exists, potentially allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors involving an error message in the cgierror function in CGI.pm.

The issue allows an attacker to execute malicious code by supplying a .pyc file, potentially tricking the AddTemplate() D-Bus method call or the DBusTestCase.spawn server template() method into executing the malicious code.

The default D-Bus access control rule in Midgard2 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

The issue is caused by an off-by-one error when running on a 64-bit system and the max message unix fds limit is set to an odd number. This allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure. The vulnerability can be exploited to compromise the confidentiality, integrity, and availability of protected information.

The issue is caused by synchronization errors when using a shared resource in the D-Bus interprocess communication system. Exploitation of this issue may allow an attacker to cause a denial of service due to the lack of functionality to check the source of the `ActivationFailure` signal. Local users can leverage a race condition involving sending an `ActivationFailure` signal before systemd responds, resulting in an activation failure error.

The issue arises from inadequate verification of X.509 certificates. Specifically, it does not check (1) if the issuer is a trusted Certificate Authority (CA), (2) if the server hostname matches a domain name in the subject's Common Name (CN), or (3) the expiration date of the certificate. This oversight allows man-in-the-middle attackers to spoof SSL servers by using any valid certificate.

The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.

The issue allows remote attackers to cause a denial of service, resulting in a divide-by-zero error and a kernel panic, through IGMP packets. This is due to the `igmp heard query` function in `net/ipv4/igmp.c`.

The issue is related to the lack of input sanitization in the Net::Ping::External extension for Perl, specifically with regards to shell metacharacters in arguments such as invalid hostnames. This allows for shell command injection and arbitrary command execution if untrusted input is used. The vulnerability can be exploited by a remote attacker to execute arbitrary commands using shell metacharacters.