5.5

CVE-2020-12049: canonical ubuntu_linux Improper Resource Shutdown or Release

CVSS: 5.5v3.1MediumModified
AliasesALPINE-CVE-2020-12049MGASA-2020-0262SUSE-SU-2021:2470-1
Published 08-06-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-12049 is a medium (CVSS 5.5) Improper Resource Shutdown or Release vulnerability in canonical ubuntu_linux. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.57%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, reference

Advisory lineage

Upstream 0 · Downstream 3 · Related 3
OPENSUSE-SU-2024:10711-1SUSE-SU-2021:2424-1SUSE-SU-2021:2590-1

Timeline

  1. 08-06-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in dbus >= 1.3.0 before 1.12.18. The DBusServer in libdbus, as used in dbus-daemon, leaks file descriptors when a message exceeds the per-message file descriptor limit. A local attacker with access to the D-Bus system bus or another system service's private AF_UNIX socket could use this to make the system service reach its file descriptor limit, denying service to subsequent D-Bus clients.

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

0.00 pp

From 0.57% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • githubUnverified

    Ghsl 2020 057 Dbus Dos File Descriptor Leak

    Maturity: poc

  • referenceUnverified

    Exploit Reference (gitlab.freedesktop.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat16 products
  • dbus< 1:1.10.24-14.el7_8 | < 1:1.12.8-10.el8_2 | < 1:1.12.8-8.el8_0 | < 1:1.12.8-10.el8_1
  • dbus-common< 1:1.12.8-10.el8_2 | < 1:1.12.8-8.el8_0 | < 1:1.12.8-10.el8_1
  • dbus-daemon< 1:1.12.8-10.el8_2 | < 1:1.12.8-8.el8_0 | < 1:1.12.8-10.el8_1
  • dbus-daemon-debuginfo< 1:1.12.8-10.el8_2 | < 1:1.12.8-8.el8_0 | < 1:1.12.8-10.el8_1
  • dbus-debuginfo< 1:1.10.24-14.el7_8 | < 1:1.12.8-10.el8_2 | < 1:1.12.8-8.el8_0 | < 1:1.12.8-10.el8_1
Suse13 products
  • dbus-1-x11&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.12.2-3.16.1
  • dbus-1-x11&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.12.2-3.16.1
  • dbus-1-x11&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.12.2-8.11.1
  • dbus-1-x11&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 1.12.2-8.11.1
  • dbus-1-x11&distro=SUSE Linux Enterprise Server 15-LTSS< 1.12.2-3.16.1
Opensuse4 products
  • dbus-1-x11&distro=openSUSE Leap 15.2< 1.12.2-lp152.6.6.1
  • dbus-1-x11&distro=openSUSE Leap 15.3< 1.12.2-8.11.1
  • dbus-1&distro=openSUSE Leap 15.2< 1.12.2-lp152.6.6.1
  • dbus-1&distro=openSUSE Leap 15.3< 1.12.2-8.11.2
Alpine1 product
  • dbus≥ 1.3.0, < 1.12.16-r1 | ≥ 1.3.0, < 1.12.16-r3 | ≥ 1.3.0, < 1.12.18-r0 | ≥ 1.3.0, < 1.12.28-r1
Canonical1 product
  • ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 19.10 | 20.04
Debian1 product
  • dbus< 1.12.18-1 | < 1.8.22-0+deb8u3
Freedesktop1 product
  • dbus≥ 1.3.0, < 1.12.18
Mageia1 product
  • dbus< 1.13.8-4.2.mga7
Ubuntu1 product
  • dbus< 1.10.6-1ubuntu3.6 | < 1.12.2-1ubuntu1.2 | < 1.12.16-2ubuntu2.1 | < 1.6.18-0ubuntu4.5+esm2

9 vendors · 39 products

References

38 links
Show all 38 references