CVE-2022-42012

Name of the Vulnerable Software and Affected Versions D-Bus versions 1.12.24 and earlier, 1.13.x, 1.14.x before 1.14.4, and 1.15.x before 1.15.2

Description An issue was discovered in D-Bus that allows an authenticated attacker to cause dbus-daemon and other programs that use libdbus to crash by sending a message with attached file descriptors in an unexpected format. The vulnerability is related to a use-after-free error caused by a message with out-of-band Unix file descriptors and a non-native byte order. This can lead to a denial-of-service.

Recommendations For D-Bus versions 1.12.24 and earlier, update to version 1.12.24 or later. For D-Bus version 1.13.x, update to version 1.14.4 or later. For D-Bus version 1.14.x before 1.14.4, update to version 1.14.4 or later. For D-Bus version 1.15.x before 1.15.2, update to version 1.15.2 or later. As a temporary workaround, consider restricting access to the dbus-daemon to minimize the risk of exploitation.