Received-SPF: pass (google.com: domain of oss-security-return-30128-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Feedback-ID: i683145e5:Fastmail
Message-ID: <218de88c60d76aafebed0f50fa7d695132025836.camel@tecnocode.co.uk>
From: Philip Withnall <philip@tecnocode.co.uk>
To: oss-security@lists.openwall.com
Date: Tue, 07 May 2024 15:16:56 +0100
Content-Type: multipart/signed; micalg="pgp-sha256";
	protocol="application/pgp-signature"; boundary="=-fPkkjTcm2uYI67WtZRRE"
User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) 
MIME-Version: 1.0
Subject: [oss-security] GLib (2.26.0+): GDBus signal subscriptions for well-known names are
 vulnerable to unicast spoofing

--=-fPkkjTcm2uYI67WtZRRE
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,

A series of related security fixes for how signal subscriptions are
handled in GDBus have just landed in GLib. They have been assigned CVE-
2024-34397:

 *=C2=A0https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4038 (changes
on main)
 *=C2=A0https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4039 (trivial
backport to glib-2-80)
 *=C2=A0https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4040 (non-
trivial backport to glib-2-78)

There is a related fix in gnome-shell which distributions should
cherry-pick at the same time, to avoid a regression in screen recording
support in gnome-shell 3.38 and newer:

 *=C2=A0https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/3303
(changes on main)
 * Backports to older versions of gnome-shell are not available yet

When a GDBus-based client subscribes to signals from a trusted system
service such as NetworkManager or logind on a shared computer, other
users of the same computer can send spoofed D-Bus signals that the
GDBus-based client will wrongly interpret as having been sent by the
trusted system service. This could lead to the GDBus-based client
behaving incorrectly, with an application-dependent impact.
Distributors are advised to cherry-pick these changes into their GLib
packages ASAP.

This issue has likely existed since GDBus was first introduced in GLib
2.26, although this lower bound has not been verified. The issue has
been verified to exist in at least GLib 2.66, 2.74, 2.78 (<2.78.5) and
2.80 (<2.80.1).

Per GLib=E2=80=99s support policy, the fixes have not been backported to gl=
ib-
2-76 or earlier.

Philip

--=-fPkkjTcm2uYI67WtZRRE
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEKgytxEoDTEz3qX0k3N9YhbHz7XMFAmY6N9gACgkQ3N9YhbHz
7XMF9hAAhyAMutZyauexqZc1Xl1EznSflIeFfHxnvCml24gOmhllhTRQ61j1RWSx
tlzgM8F33hoSmW2s9ajKcvVmcmPI4X8OrfqpoeAvl+k4XAxW0Ew1XUlYkByRTCbS
2qKeSPSMSHFvamUNHCRr5rjMETVrCtA7MC0INITWXbGP6Rxyb4lU2/mTrpP9N4oe
j8Jayp8lYOtHlzoq4G2idAfPqpMcFBWL6HxRBj1CCqkO1y0asFYA1ENSRUMrGoFq
nr/aUY7CZhzgPBn6k8IuHnStij+i9DDweS9ye/g75eK6ovebKOdn5P3dTXEYkYqy
K752xAqnaxHvYLUA5Wgnhkmt3gyUyAdJk6j3prJ657buqthJ6AqdUWIj+pHXJP7l
2A90Sga7bcMfCD8w5EKVWlDujX0WpqtqCKC0ota7ddj24zNS5Nln2ly/24LRoPg4
fOL/84V8yPJib9+EAUeJfbdWHXqYjqfTs9bcfz5YlMzqBukXJI+tGDPxgO4ONaG6
GqAuPyyoa+hqFgIEVEIQzq1TkXkIEKrGdmfD4si7CHFOezU5ovHs+cLspHOQKyjB
vBaRZQqFy5Z2FLS9rv2JFA/MMGPVoy2oVTFLagyQdvwORWK83i2vOZHsVRRkKqba
GUszFjmLuM48iD2Y6j5BuoZSGzaA3e4J+RFgG6U0QvvvNWyj6mo=
=2fqa
-----END PGP SIGNATURE-----

--=-fPkkjTcm2uYI67WtZRRE--