Arbitrary TCP DBus Connections Possible with is_closing_session()

CVE-2022-28655

Summary

A vulnerability exists within the D-Bus functionality of the Ubuntu operating system, primarily affecting users' ability to restrict arbitrary TCP connections. The flaw allows attackers to create unauthorized D-Bus connections, potentially enabling them to send and receive messages between applications and services that can lead to manipulation and unauthorized access. This vulnerability underscores the importance of securing D-Bus interfaces and ensuring that only trusted connections are permitted to maintain system integrity.

References