CVE-2014-3635

What it actually does

Off-by-one error in D-Bus on 64-bit systems triggers heap-based buffer overflow or assertion failure when a local process sends one extra file descriptor beyond an odd-numbered max_message_unix_fds limit, enabling denial of service via daemon crash or potential arbitrary code execution.

Why it matters to the business

Local attackers can crash inter-process messaging services on Linux systems, causing application outages, service restarts, or limited code execution that disrupts operations and requires emergency patching on affected distributions.

How an attack unfolds

A local user identifies a D-Bus daemon configured with an odd max_message_unix_fds value, crafts a message containing one additional file descriptor, and sends it to trigger the off-by-one overflow or assertion, resulting in a crash or code execution on 64-bit hosts.

How to fix it

Upgrade D-Bus to version 1.6.24 or 1.8.8 or later on all affected systems; rebuild and restart dependent services; verify the max_message_unix_fds limit is set to an even value if custom configuration is required.

How to confirm the fix worked

Confirm installed D-Bus package version meets or exceeds 1.6.24/1.8.8; run regression tests that exercise file-descriptor passing under odd limits; monitor dbus-daemon logs for absence of buffer-related crashes after upgrade.

Typical attack path

1. Obtain local shell or process execution on the target host
2. Inspect or influence D-Bus configuration to confirm odd max_message_unix_fds setting
3. Construct and transmit a Unix message with one extra file descriptor
4. Trigger heap overflow or assertion failure leading to dbus-daemon crash or code execution

How to detect it

Search system and D-Bus logs for repeated dbus-daemon crashes or assertion failures around file-descriptor handling; correlate with local process activity sending Unix messages with high file-descriptor counts.

What your security team should do

• Prioritize patching D-Bus packages on all 64-bit Linux hosts within the next maintenance window
• Audit running D-Bus configurations for odd max_message_unix_fds values and correct them
• Enable verbose logging and crash reporting for dbus-daemon to detect future anomalies
• Review downstream packages that depend on D-Bus for additional updates