CVE-2020-16126 accountsservice drops ruid, allows unprivileged users to send it signals
Unprivileged users can send signals to AccountsService due to improper ruid dropping, causing denial of service and potential privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-16126?
CVE-2020-16126 is a low-severity vulnerability in Freedesktop accountsservice, published on 11 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.
Weakness: CWE-269
Which versions are affected by CVE-2020-16126?
It affects 1 product.
Products include Freedesktop Accountsservice.
How do I fix CVE-2020-16126?
Apply the vendor's patch.
Is CVE-2020-16126 being exploited?
There is no known exploitation of CVE-2020-16126 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Freedesktop accountsservice
Sources
Also known as GHSA-37qh-6xc5-7fm4, UBUNTU-CVE-2020-16126.