Attack Chain

1. Initial Access: A malicious actor gains access to the same D-Bus instance as the target application. This could be achieved through compromising a separate process on the same system.
2. Name Enumeration: The attacker enumerates available well-known names on the D-Bus to identify potential targets for impersonation.
3. Signal Spoofing: The attacker crafts a D-Bus message that spoofs a signal originating from the owner of a well-known name, taking advantage of the vulnerability in Tmds.DBus to bypass authentication.
4. Resource Exhaustion: The attacker sends a series of D-Bus messages to the target application, each containing a large number of Unix file descriptors.
5. File Descriptor Spillover: The target application attempts to process the messages, leading to an excessive consumption of file descriptors.
6. Denial of Service (Resource): The exhaustion of file descriptors prevents the target application from handling legitimate requests, leading to a denial-of-service condition.
7. Application Crash: Alternatively, the attacker sends a D-Bus message with a malformed message body specifically crafted to trigger an unhandled exception in the target application's SynchronizationContext.
8. Denial of Service (Crash): The unhandled exception causes the target application to crash, resulting in a denial-of-service condition.

Impact

Successful exploitation can lead to a range of consequences, including unauthorized actions performed under the guise of a legitimate service, resource exhaustion causing system instability, and application crashes leading to service outages. The number of victims depends on the number of applications utilizing vulnerable versions of Tmds.DBus and Tmds.DBus.Protocol on a shared D-Bus instance. The impact is particularly severe in environments where D-Bus is used for critical inter-process communication, such as system services and desktop environments.

Recommendation

• Upgrade Tmds.DBus to version 0.92.0 or later to address the signal spoofing, resource exhaustion, and denial-of-service vulnerabilities.
• Upgrade Tmds.DBus.Protocol to version 0.21.3 or later or version 0.92.0 or later to address the signal spoofing, resource exhaustion, and denial-of-service vulnerabilities.
• Monitor D-Bus traffic for suspicious messages containing an unusually large number of Unix file descriptors using a network monitoring tool with visibility into D-Bus protocols. Consider developing a custom rule for this.