No Limit on Number of Open Sessions Leads to Memory Exhaustion and Impacts Availability

CVE-2024-1930

Summary

A session management flaw exists in the DNF5 Daemon Server, allowing malicious users to create an unlimited number of open sessions via the open_session() D-Bus method. This behavior results in the generation of multiple threads, each consuming significant memory resources. As the number of sessions grows, the system approaches its memory limits, which ultimately prevents new connections from being established. This may lead to service unavailability, impacting the overall performance of applications reliant on the DNF5 Daemon Server. The vulnerability is significant as it highlights potential risks associated with resource exhaustion in multi-threaded environments.

References