diff options
author | Alban Crequy <alban.crequy@collabora.co.uk> | 2014-06-24 17:57:14 +0100 |
---|---|---|
committer | Simon McVittie <simon.mcvittie@collabora.co.uk> | 2014-06-30 14:09:21 +0100 |
commit | 9ca90648fc870c24d852ce6d7ce9387a9fc9a94a (patch) | |
tree | b358d28197da97ec17467ca527a672fda16779a2 /configure.ac | |
parent | 07f4c12efe3b9bd45d109bc5fbaf6d9dbf69d78e (diff) | |
download | dbus-9ca90648fc870c24d852ce6d7ce9387a9fc9a94a.tar.gz |
Handle ETOOMANYREFS when sending recursive fds (SCM_RIGHTS)
Since Linux commit 25888e (from 2.6.37-rc4, Nov 2010), sendmsg() on Unix
sockets returns -1 errno=ETOOMANYREFS ("Too many references: cannot splice")
when the passfd mechanism (SCM_RIGHTS) is "abusively" used recursively by
applications. A malicious client could use this to force a victim system
service to be disconnected from the system bus; the victim would likely
respond by exiting. This is a denial of service (fd.o #80163,
CVE-2014-3532).
This patch silently drops the D-Bus message on ETOOMANYREFS and does not close
the connection.
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=80163
Reviewed-by: Thiago Macieira <thiago@kde.org>
[altered commit message to explain DoS significance -smcv]
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Diffstat (limited to 'configure.ac')
0 files changed, 0 insertions, 0 deletions