File Descriptor Leak in D-Bus Server of dbus Daemon by Freedesktop

CVE-2020-12049

What is CVE-2020-12049?

A vulnerability exists in the D-Bus server implementation within the libdbus library, where file descriptors may be leaked when messages exceed the allowed per-message limit. A local attacker with access to the D-Bus system bus or a private AF_UNIX socket from another system service can exploit this flaw, potentially overwhelming the system service and preventing subsequent D-Bus clients from functioning properly due to reaching the file descriptor limit.

References