CVE-2023-34969
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
D-Bus before 1.15.6 allows unprivileged users to crash dbus-daemon. If a privileged user is monitoring message bus traffic, an unprivileged user can cause a dbus-daemon crash by sending an unreplyable message.
Risk Assessment
This vulnerability can lead to a denial-of-service (DoS) on the system bus, potentially disrupting applications that rely on D-Bus within the organization.
Recommendation
It is recommended to upgrade D-Bus to versions 1.12.28, 1.14.8, or 1.15.6 to mitigate the risks associated with this vulnerability.
Original NVD description (English source)
D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over the dbus-daemon is using the org.freedesktop.DBus.Monitoring interface to monitor message bus traffic, then an unprivileged user with the ability to connect to the same dbus-daemon can cause a dbus-daemon crash under some circumstances via an unreplyable message. When done on the well-known system bus, this is a denial-of-service vulnerability. The fixed versions are 1.12.28, 1.14.8, and 1.15.6.