Vulnerabilities > CVE-2020-16127 - Infinite Loop vulnerability in Freedesktop Accountsservice

CVSS 2.1 - LOW

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

PARTIAL

local

low complexity

freedesktop

CWE-835

NVD

Published: 2020-11-11

Updated: 2020-11-24

Summary

An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, would perform unbounded read operations on user-controlled ~/.pam_environment files, allowing an infinite loop if /dev/zero is symlinked to this location.

Vulnerable Configurations

Part	Description	Count
Application	Freedesktop Freedesktop Accountsservice 0.2 Freedesktop Accountsservice 0.3 Freedesktop Accountsservice 0.4 Freedesktop Accountsservice 0.5 Freedesktop Accountsservice 0.6.1 Freedesktop Accountsservice 0.6.2 Freedesktop Accountsservice 0.6.3 Freedesktop Accountsservice 0.6.4 Freedesktop Accountsservice 0.6.5 Freedesktop Accountsservice 0.6.6 Freedesktop Accountsservice 0.6.7 Freedesktop Accountsservice 0.6.8 Freedesktop Accountsservice 0.6.9 Freedesktop Accountsservice 0.6.10 Freedesktop Accountsservice 0.6.11 Freedesktop Accountsservice 0.6.12 Freedesktop Accountsservice 0.6.13 Freedesktop Accountsservice 0.6.14 Freedesktop Accountsservice 0.6.15 Freedesktop Accountsservice 0.6.16 Freedesktop Accountsservice 0.6.17 Freedesktop Accountsservice 0.6.18 Freedesktop Accountsservice 0.6.19 Freedesktop Accountsservice 0.6.20 Freedesktop Accountsservice 0.6.21 Freedesktop Accountsservice 0.6.22 Freedesktop Accountsservice 0.6.23 Freedesktop Accountsservice 0.6.24 Freedesktop Accountsservice 0.6.25 Freedesktop Accountsservice 0.6.26 Freedesktop Accountsservice 0.6.27 Freedesktop Accountsservice 0.6.28 Freedesktop Accountsservice 0.6.29 Freedesktop Accountsservice 0.6.30 Freedesktop Accountsservice 0.6.31 Freedesktop Accountsservice 0.6.32 Freedesktop Accountsservice 0.6.33 Freedesktop Accountsservice 0.6.34 Freedesktop Accountsservice 0.6.35 Freedesktop Accountsservice 0.6.36 Freedesktop Accountsservice 0.6.37 Freedesktop Accountsservice 0.6.38 Freedesktop Accountsservice 0.6.39 Freedesktop Accountsservice 0.6.40 Freedesktop Accountsservice 0.6.42 Freedesktop Accountsservice 0.6.43 Freedesktop Accountsservice 0.6.44 Freedesktop Accountsservice 0.6.45 Freedesktop Accountsservice 0.6.46 Freedesktop Accountsservice 0.6.47 Freedesktop Accountsservice 0.6.48 Freedesktop Accountsservice 0.6.49 Freedesktop Accountsservice 0.6.50	53

Common Weakness Enumeration (CWE)

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

References

https://securitylab.github.com/advisories/GHSL-2020-187-accountsservice-drop-privs-DOS