CVE-2019-12795 : What You Need to Know

A vulnerability in the gvfsd daemon in GNOME gvfs versions allowed a local attacker to establish a connection to a private D-Bus server socket, potentially leading to unauthorized D-Bus method calls.

Understanding CVE-2019-12795

This CVE describes a security issue in GNOME gvfs versions before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 related to the handling of a private D-Bus server socket.

What is CVE-2019-12795?

The gvfsd daemon in GNOME gvfs versions had a vulnerability where it opened a private D-Bus server socket without setting up an authorization rule. This flaw could allow a local attacker to connect to the server socket and make unauthorized D-Bus method calls.

The Impact of CVE-2019-12795

The vulnerability could be exploited by a local attacker to establish a connection to the server socket and potentially perform unauthorized D-Bus method calls. However, the server socket could only accept a single connection, requiring the attacker to connect before the legitimate owner.

Technical Details of CVE-2019-12795

This section provides more in-depth technical details about the vulnerability.

Vulnerability Description

The gvfsd daemon in GNOME gvfs versions before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. This could allow a local attacker to connect to the server socket and issue D-Bus method calls.

Affected Systems and Versions

GNOME gvfs versions before 1.38.3
GNOME gvfs 1.40.x before 1.40.2
GNOME gvfs 1.41.x before 1.41.3

Exploitation Mechanism

The vulnerability could be exploited by a local attacker who locates the server and connects to the server socket before its legitimate owner, enabling them to make unauthorized D-Bus method calls.

Mitigation and Prevention

To address CVE-2019-12795, follow these mitigation strategies:

Immediate Steps to Take

Update GNOME gvfs to versions 1.38.3, 1.40.2, or 1.41.3, which contain fixes for the vulnerability.
Monitor for any unauthorized D-Bus method calls on the server socket.

Long-Term Security Practices

Implement strict access controls and authorization rules for D-Bus server sockets.
Regularly audit and review D-Bus configurations for security vulnerabilities.

Patching and Updates

Apply the security updates provided by GNOME for gvfs to patch the vulnerability and enhance system security.