An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Accountsservice | Freedesktop | * | 0.6.55 (excluding) |
| Accountsservice | Ubuntu | bionic | * |
| Accountsservice | Ubuntu | devel | * |
| Accountsservice | Ubuntu | esm-infra-legacy/trusty | * |
| Accountsservice | Ubuntu | esm-infra/bionic | * |
| Accountsservice | Ubuntu | esm-infra/focal | * |
| Accountsservice | Ubuntu | esm-infra/xenial | * |
| Accountsservice | Ubuntu | focal | * |
| Accountsservice | Ubuntu | groovy | * |
| Accountsservice | Ubuntu | trusty | * |
| Accountsservice | Ubuntu | trusty/esm | * |
| Accountsservice | Ubuntu | xenial | * |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html