Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.12% · 2nd percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 21/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
An unprivileged local user can crash the D-Bus daemon (dbus-daemon) when a driver broadcast, such as NameOwnerChanged, cannot be delivered while a privileged monitoring client like dbus-monitor is attached, which causes a denial of service. The flaw is reached locally without logging in and without any user action, and it is an incomplete fix for CVE-2023-34969.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. No advisory context yet
- Reach10/20Shipped in major Linux distributions
- Severity6.2/10CVSS 6.2
- No patch5/5No patch listed yet
What would change the score
- Would score about 76 if added to CISA KEV
- Would score about 71 if CISA's SSVC rates exploitation active
- Would score about 43 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
Affected versions
- dbus
Version range not reported
- dbus
Version range not reported
- dbus
Version range not reported
- dbus
Version range not reported
- dbus
Version range not reported
- dbus
Version range not reported
Evidence 5
- Report
- Link
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.