CVE-2022-28655
📋 TL;DR
CVE-2022-28655 is a vulnerability in the is_closing_session() function that allows users to create arbitrary TCP D-Bus connections, potentially bypassing intended access controls. This affects systems using D-Bus with vulnerable implementations, particularly those with user accounts that can interact with D-Bus services. The vulnerability could enable unauthorized communication between processes or services.
💻 Affected Systems
- D-Bus implementations with vulnerable is_closing_session() function
📦 What is this software?
Apport by Apport Project
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Attackers could establish unauthorized D-Bus connections to sensitive system services, potentially leading to privilege escalation, data exfiltration, or service disruption.
Likely Case
Local users could bypass intended D-Bus access controls to communicate with services they shouldn't have access to, potentially accessing sensitive information or functionality.
If Mitigated
With proper network segmentation and D-Bus policy controls, impact would be limited to unauthorized local D-Bus communication within the same security context.
🎯 Exploit Status
Requires local user access and knowledge of D-Bus TCP connection mechanisms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched versions referenced in Ubuntu USN-5427-1
Vendor Advisory: https://ubuntu.com/security/notices/USN-5427-1
Restart Required: Yes
Instructions:
1. Update D-Bus package using system package manager. 2. For Ubuntu: sudo apt update && sudo apt upgrade dbus. 3. Restart affected services or reboot system.
🔧 Temporary Workarounds
Disable D-Bus TCP connections
linuxPrevent D-Bus from accepting TCP connections if not required
Edit /etc/dbus-1/system.conf and comment out or remove <listen>tcp:host=localhost,port=0</listen>
Restart D-Bus: sudo systemctl restart dbus
🧯 If You Can't Patch
- Implement strict D-Bus policy controls to limit which users can create connections
- Use network segmentation to isolate systems with vulnerable D-Bus implementations
🔍 How to Verify
Check if Vulnerable:
Check D-Bus version: dbus-daemon --version. Compare against patched versions in vendor advisories.Check Version:
dbus-daemon --versionVerify Fix Applied:
Verify updated D-Bus version and test that arbitrary TCP D-Bus connections cannot be established.📡 Detection & Monitoring
Log Indicators:
- Unusual D-Bus connection attempts in system logs
- Failed authentication attempts for D-Bus services
Network Indicators:
- Unexpected TCP connections to D-Bus ports (typically 55554 for session bus)
SIEM Query:
source="systemd-journald" AND "dbus" AND ("connection" OR "authentication")