Created attachment 621964 [details]
Proposed patch

Date: Tue, 27 Jan 2015 15:47:31 +0000
From: Simon McVittie <simon.mcvittie@collabora.co.uk>

Tracked as: https://bugs.freedesktop.org/show_bug.cgi?id=88811
Versions affected: dbus >= 1.4.0
Type of vulnerability: CWE-285 Improper Authorization
Exploitable by: local users
Impact: denial of service
Reporter: Simon McVittie, Collabora Ltd.

D-Bus <http://www.freedesktop.org/wiki/Software/dbus/> is an
asynchronous inter-process communication system, commonly used
for system services or within a desktop session on Linux and other
operating systems.

dbus-daemon can "activate" (auto-start) D-Bus services on-demand when it
receives a message addressed to them. In versions >= 1.4.0 of dbus, it
can do this by using a D-Bus signal to ask systemd to carry out the
actual service start.

systemd sends back an ActivationFailure D-Bus signal if the activation
fails. However, when it receives these signals, dbus-daemon does not
verify that the signal actually came from systemd. A malicious local
user could send repeated ActivationFailure signals in the hope that it
would "win the race" with the genuine signal, causing D-Bus to send back
an error to the client that requested activation.

Mitigation: the system service is not actually prevented from starting
or claiming its well-known bus name, and after it has done so,
subsequent clients can communicate with it as usual.