From 29c64424d174a20449846479e7eeaa87821d78be Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Tue, 18 Nov 2014 12:01:44 +0000 Subject: [PATCH 1/3] Log to syslog when auth_timeout drops an incomplete connection This is a symptom of either a denial of service attack, or a serious performance problem. Either way, sysadmins should know. Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431 --- bus/connection.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/bus/connection.c b/bus/connection.c index 519122c5..7107434f 100644 --- a/bus/connection.c +++ b/bus/connection.c @@ -860,6 +860,14 @@ bus_connections_expire_incomplete (BusConnections *connections) if (elapsed >= (double) auth_timeout) { + /* Unfortunately, we can't identify the connection: it doesn't + * have a unique name yet, we don't know its uid/pid yet, + * and so on. */ + bus_context_log (connections->context, DBUS_SYSTEM_LOG_INFO, + "Connection has not authenticated soon enough, closing it " + "(auth_timeout=%dms, elapsed: %.0fms)", + auth_timeout, elapsed); + _dbus_verbose ("Timing out authentication for connection %p\n", connection); dbus_connection_close (connection); } From 02e1ddf91e27405c0b88303bb49f5bf5c56306f8 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Tue, 18 Nov 2014 17:34:11 +0000 Subject: [PATCH 2/3] Revert "config: change default auth_timeout to 5 seconds" This reverts commit 54d26df52b6a394bea175651d1d7ad2ab3f87dea. It appears this change may cause intermittent slow or failed boot, more commonly on slower/older machines, in at least Mageia and possibly also Debian. This would indicate that while the system is under load, system services are not completing authentication within 5 seconds. This change was not the main part of fixing CVE-2014-3639, but does help to mitigate that attack. As such, increasing this timeout makes the denial of service attack described by CVE-2014-3639 somewhat more effective: a local user connecting to the system bus repeatedly from many parallel processes can cause other users' attempts to connect to take longer. If your machine boots reliably with the shorter timeout, and resilience against local denial of service attacks is important to you, putting this in /etc/dbus-1/system-local.conf or a file matching /etc/dbus-1/system.d/*.conf can restore the lower limit: 5000 Bug: https://bugs.freedesktop.org/show_bug.cgi?id=86431 --- bus/config-parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bus/config-parser.c b/bus/config-parser.c index 7bc9c019..ee2d4e7d 100644 --- a/bus/config-parser.c +++ b/bus/config-parser.c @@ -438,7 +438,7 @@ bus_config_parser_new (const DBusString *basedir, * and legitimate auth will fail. If interactive auth (ask user for * password) is allowed, then potentially it has to be quite long. */ - parser->limits.auth_timeout = 5000; /* 5 seconds */ + parser->limits.auth_timeout = 30000; /* 30 seconds */ /* Do not allow a fd to stay forever in dbus-daemon * https://bugs.freedesktop.org/show_bug.cgi?id=80559 From 4afb7a7412bee7934e532cd33ed10634314c247f Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Mon, 24 Nov 2014 13:01:40 +0000 Subject: [PATCH 3/3] 1.8.12 --- NEWS | 22 +++++++++++++++++++++- configure.ac | 4 ++-- 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index 0bf18707..c0d2fa2b 100644 --- a/NEWS +++ b/NEWS @@ -1,8 +1,28 @@ -D-Bus 1.8.12 (UNRELEASED) +D-Bus 1.8.12 (2014-11-24) == +The “days of fuchsia passed” release. + Fixes: +• Partially revert the CVE-2014-3639 patch by increasing the default + authentication timeout on the system bus from 5 seconds back to 30 + seconds, since this has been reported to cause boot regressions for + some users, mostly with parallel boot (systemd) on slower hardware. + + On fast systems where local users are considered particularly hostile, + administrators can return to the 5 second timeout (or any other value + in milliseconds) by saving this as /etc/dbus-1/system-local.conf: + + + 5000 + + + (fd.o #86431, Simon McVittie) + +• Add a message in syslog/the Journal when the auth_timeout is exceeded + (fd.o #86431, Simon McVittie) + • Send back an AccessDenied error if the addressed recipient is not allowed to receive a message (and in builds with assertions enabled, don't assert under the same conditions). (fd.o #86194, Jacek Bukarewicz) diff --git a/configure.ac b/configure.ac index 3727b1b3..cd4542a1 100644 --- a/configure.ac +++ b/configure.ac @@ -3,7 +3,7 @@ AC_PREREQ([2.63]) m4_define([dbus_major_version], [1]) m4_define([dbus_minor_version], [8]) -m4_define([dbus_micro_version], [11]) +m4_define([dbus_micro_version], [12]) m4_define([dbus_version], [dbus_major_version.dbus_minor_version.dbus_micro_version]) AC_INIT([dbus],[dbus_version],[https://bugs.freedesktop.org/enter_bug.cgi?product=dbus],[dbus]) @@ -37,7 +37,7 @@ LT_CURRENT=11 ## increment any time the source changes; set to ## 0 if you increment CURRENT -LT_REVISION=8 +LT_REVISION=9 ## increment if any interfaces have been added; set to 0 ## if any interfaces have been changed or removed. removal has