CVE-2023-34969

dbus: dbus-daemon: assertion failure when a monitor is active and a message from the driver cannot be delivered

Published Jun 8, 2023 CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed
Description
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-3628-1 dbus security update
EUVD EUVD EUVD-2023-39008 D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.
Ubuntu USN Ubuntu USN USN-6372-1 DBus vulnerability
History
Type Values Removed Values Added
Weaknesses CWE-404
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Oct 14, 2026, 11:21 PM
Reserved
Jun 8, 2023, 12:00 AM
Status
Modified
Published
Jun 8, 2023, 3:15 AM
Modified
Oct 15, 2026, 12:16 AM
Severity
Moderate
Public date
Jun 6, 2023, 12:00 AM