CyberRota Analysis
AI-GeneratedOpenSSL versions 1.4.x prior to 1.4.9 are vulnerable due to an unprotected D-Bus crypto service that allows any local user to invoke the org.freedesktop.DBus.Properties.Set method without authorization. This can lead to a denial of service by manipulating MaxConcurrentOperations or DefaultTimeout settings, effectively disrupting operations of the root daemon. Organizations using affected versions should prioritize remediation to prevent potential service disruptions caused by unauthorized local users.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
Related CVEs
Other vulnerabilities affecting the same vendor(s)