Vulnerabilities > CVE-2020-35512 - Use After Free vulnerability in Freedesktop Dbus 1.12.20

047910
CVSS 7.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
freedesktop
CWE-416
NVD
Published: 2021-02-15
Updated: 2024-11-21

Summary

A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors

Vulnerable Configurations

Part Description Count
Application
Freedesktop
1
OS
Linux
1

Common Weakness Enumeration (CWE)

References