CVE-2019-12795: gvfsd GetConnection() missing authorization check

Debian Bug report logs - #930376
CVE-2019-12795: gvfsd GetConnection() missing authorization check

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gvfsd GetConnection() missing authorization check

Date: Tue, 11 Jun 2019 17:45:56 +0100

Package: gvfs-daemons
Version: 1.14.1-1
Severity: grave
Tags: security fixed-upstream patch
Forwarded: https://gitlab.gnome.org/GNOME/gvfs/commit/70dbfc68a79faac49bd3423e079cb6902522082a

While looking for services that might be vulnerable to CVE-2019-12749
or a similar vulnerability, I noticed that gvfsd has a mechanism to open
a private D-Bus server socket, and does not configure an authorization
check for clients connecting to that socket. An attacker who learns the
abstract socket address from netstat(8) or similar could connect to it
and issue D-Bus method calls.

Mitigation: the attacker would have to win a race with the user owning
gvfsd, who is probably also trying to connect to the same socket. gvfsd
closes the socket after it has accepted one connection.

I have requested a CVE ID from MITRE but not received one yet.

For buster/sid this has been fixed in gvfs 1.38.1-5.

For experimental this has been fixed in gvfs 1.40.1-2.

I do not have a tested patch for stretch or jessie, but the same change
would probably work as-is.

It would probably be a good idea to also backport
https://gitlab.gnome.org/GNOME/gvfs/commit/16a275041de2e70063da8aa5cfb2804de9a2f60a
for additional hardening. This forces authentication to use the
simple, robust EXTERNAL (credentials-passing) mechanism, disabling
DBUS_COOKIE_SHA1, which is somewhat fragile and seems more likely to
contain unknown vulnerabilities.

Regards,
    smcv

Message #10 received at 930376-done@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 930376-done@bugs.debian.org

Subject: Re: Bug#930376: gvfsd GetConnection() missing authorization check

Date: Tue, 11 Jun 2019 17:58:59 +0100

Version: 1.38.1-5

On Tue, 11 Jun 2019 at 17:45:56 +0100, Simon McVittie wrote:
> For buster/sid this has been fixed in gvfs 1.38.1-5.

Message #15 received at 930376-done@bugs.debian.org (full text, mbox, reply):

From: Simon McVittie <smcv@debian.org>

To: 930376-done@bugs.debian.org

Subject: Re: Bug#930376: gvfsd GetConnection() missing authorization check

Date: Tue, 11 Jun 2019 18:00:41 +0100

Version: 1.40.1-3

On Tue, 11 Jun 2019 at 17:45:56 +0100, Simon McVittie wrote:
> For buster/sid this has been fixed in gvfs 1.40.1-2

Correction: 1.40.1-2 is vulnerable, 1.40.1-3 is fixed.

    smcv

Send a report that this bug log contains spam.