CVE-2020-35512

{"containers": {"cna": {"affected": [{"product": "D-Bus Development branch", "vendor": "n/a", "versions": [{"status": "affected", "version": "<= 1.13.16 (Fixed: >= 1.13.18)"}]}, {"product": "dbus-1.12.x stable branch", "vendor": "n/a", "versions": [{"status": "affected", "version": "<= 1.12.18 (Fixed: >= 1.12.20)"}]}, {"product": "dbus-1.10.x and older branches (EOL)", "vendor": "n/a", "versions": [{"status": "affected", "version": "<= 1.10.30 (Fixed: 1.10.32)"}]}], "descriptions": [{"lang": "en", "value": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}], "problemTypes": [{"descriptions": [{"description": "Use-After-Free", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-03-08T20:46:11.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugs.gentoo.org/755392"}, {"tags": ["x_refsource_MISC"], "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"}, {"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"}, {"tags": ["x_refsource_MISC"], "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2020-35512", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "D-Bus Development branch", "version": {"version_data": [{"version_value": "<= 1.13.16 (Fixed: >= 1.13.18)"}]}}, {"product_name": "dbus-1.12.x stable branch", "version": {"version_data": [{"version_value": "<= 1.12.18 (Fixed: >= 1.12.20)"}]}}, {"product_name": "dbus-1.10.x and older branches (EOL)", "version": {"version_data": [{"version_value": "<= 1.10.30 (Fixed: 1.10.32)"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Use-After-Free"}]}]}, "references": {"reference_data": [{"name": "https://bugs.gentoo.org/755392", "refsource": "MISC", "url": "https://bugs.gentoo.org/755392"}, {"name": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128", "refsource": "MISC", "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"}, {"name": "https://security-tracker.debian.org/tracker/CVE-2020-35512", "refsource": "MISC", "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:02:08.036Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.gentoo.org/755392"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-19T15:31:25.634957Z", "id": "CVE-2020-35512", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-19T15:32:44.371Z"}}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2020-35512", "datePublished": "2021-02-15T16:08:39.000Z", "dateReserved": "2020-12-17T00:00:00.000Z", "dateUpdated": "2024-11-19T15:32:44.371Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugs.gentoo.org/755392", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://security-tracker.debian.org/tracker/CVE-2020-35512", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T17:02:08.036Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-35512", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-19T15:31:25.634957Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-19T15:32:39.731Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "D-Bus Development branch", "versions": [{"status": "affected", "version": "<= 1.13.16 (Fixed: >= 1.13.18)"}]}, {"vendor": "n/a", "product": "dbus-1.12.x stable branch", "versions": [{"status": "affected", "version": "<= 1.12.18 (Fixed: >= 1.12.20)"}]}, {"vendor": "n/a", "product": "dbus-1.10.x and older branches (EOL)", "versions": [{"status": "affected", "version": "<= 1.10.30 (Fixed: 1.10.32)"}]}], "references": [{"url": "https://bugs.gentoo.org/755392", "tags": ["x_refsource_MISC"]}, {"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128", "tags": ["x_refsource_MISC"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101", "tags": ["x_refsource_MISC"]}, {"url": "https://security-tracker.debian.org/tracker/CVE-2020-35512", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Use-After-Free"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2021-03-08T20:46:11.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "<= 1.13.16 (Fixed: >= 1.13.18)"}]}, "product_name": "D-Bus Development branch"}, {"version": {"version_data": [{"version_value": "<= 1.12.18 (Fixed: >= 1.12.20)"}]}, "product_name": "dbus-1.12.x stable branch"}, {"version": {"version_data": [{"version_value": "<= 1.10.30 (Fixed: 1.10.32)"}]}, "product_name": "dbus-1.10.x and older branches (EOL)"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://bugs.gentoo.org/755392", "name": "https://bugs.gentoo.org/755392", "refsource": "MISC"}, {"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128", "name": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128", "refsource": "MISC"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101", "refsource": "MISC"}, {"url": "https://security-tracker.debian.org/tracker/CVE-2020-35512", "name": "https://security-tracker.debian.org/tracker/CVE-2020-35512", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Use-After-Free"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-35512", "STATE": "PUBLIC", "ASSIGNER": "secalert@redhat.com"}}}}, "cveMetadata": {"cveId": "CVE-2020-35512", "state": "PUBLISHED", "dateUpdated": "2024-11-19T15:32:44.371Z", "dateReserved": "2020-12-17T00:00:00.000Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2021-02-15T16:08:39.000Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "D-Bus Development branch", "vendor": "n/a", "versions": [{"status": "affected", "version": "<= 1.13.16 (Fixed: >= 1.13.18)"}]}, {"product": "dbus-1.12.x stable branch", "vendor": "n/a", "versions": [{"status": "affected", "version": "<= 1.12.18 (Fixed: >= 1.12.20)"}]}, {"product": "dbus-1.10.x and older branches (EOL)", "vendor": "n/a", "versions": [{"status": "affected", "version": "<= 1.10.30 (Fixed: 1.10.32)"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:freedesktop:dbus:1.12.20:*:*:*:*:*:*:*", "matchCriteriaId": "D03731AA-A978-47F1-AE31-4873554468E8", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors"}, {"lang": "es", "value": "Se encontr\u00f3 un fallo de uso de la memoria previamente liberada D-Bus rama de desarrollo versiones iguales o anteriores a 1.13.16, dbus-1.12.x rama estable versiones iguales o anteriores a 1.12.18, y dbus-1.10.x y ramas anteriores versiones iguales o anteriores a 1.10.30 cuando un sistema tiene m\u00faltiples nombres de usuario que comparten el mismo UID. Cuando un conjunto de reglas de pol\u00edtica hace referencia a estos nombres de usuario, D-Bus puede liberar algo de memoria en la pila, que sigue siendo utilizada por las estructuras de datos necesarias para los otros nombres de usuario que comparten el UID, lo que puede provocar un fallo u otros comportamientos indefinidos"}], "id": "CVE-2020-35512", "lastModified": "2026-06-17T03:13:50.667", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.2, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-35512", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-19T15:31:25.634957Z", "version": "2.0.3"}}]}, "published": "2021-02-15T17:15:12.993", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.gentoo.org/755392"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"}, {"source": "secalert@redhat.com", "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"}, {"source": "secalert@redhat.com", "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.gentoo.org/755392"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "dbus: users with the same numeric UID could lead to use-after-free and undefined behaviour", "id": "1909101", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors", "A use-after-free flaw was found in D-Bus when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors."], "name": "CVE-2020-35512", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Out of support scope", "package_name": "dbus", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "dbus", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "dbus", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "dbus", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "dbus", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2020-06-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-35512\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-35512"], "statement": "Regarding the concern with D-Bus, users with the same UID are treated as the same user. As in Linux, multiple assumptions are made based on the fact that a user is identified by its UID. It is not advisable to have multiple users with different privileges and the same UID on systems where D-Bus is used. For these reasons, this vulnerability has been rated as having Low Impact.", "threat_severity": "Low"}

{}