GHSL-2023-139: use-after-free in user.c

[kev]

# GitHub Security Lab (GHSL) Vulnerability Report, accountsservice: `GHSL-2023-139`

The [GitHub Security Lab](https://securitylab.github.com) team has identified a potential security vulnerability in [accountsservice](https://code.launchpad.net/ubuntu/+source/accountsservice).

We are committed to working with you to help resolve this issue. In this report you will find everything you need to effectively coordinate a resolution of this issue with the GHSL team.

If at any point you have concerns or questions about this process, please do not hesitate to reach out to us at `<email address hidden>` (please include `GHSL-2023-139` as a reference).

If you are _NOT_ the correct point of contact for this report, please let us know!

## Summary

An unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus message to the accounts-daemon process.

## Product

accountsservice

## Tested Version

[22.08.8-1ubuntu7](https://launchpad.net/ubuntu/+source/accountsservice/22.08.8-1ubuntu7)

The bug is easier to observe on Ubuntu 23.04 than on Ubuntu 22.04 LTS, but it is present on both.

## Details

### Use-after-free when `throw_error` is called (`GHSL-2023-139`)

After receiving a D-Bus [method call](https://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-types), a D-Bus server is expected to send either a `METHOD_RETURN` or a `ERROR` message back to the client, _but not both_. This is done incorrectly in several places in accountsservice. For example, in [`user_change_language_authorized_cb`](https://git.launchpad.net/ubuntu/+source/accountsservice/tree/debian/patches/0010-set-language.patch?h=import/22.08.8-1ubuntu7#n427):

```c
static void
user_change_language_authorized_cb (Daemon *daemon,
                                    User *user,
                                    GDBusMethodInvocation *context,
                                    gpointer data)

{
        const gchar *language = data;

        if (!user_HOME_available (user)) {

                /* SetLanguage was probably called from a login greeter,
                   and HOME not mounted and/or not decrypted.
                   Hence don't save anything, or else accountsservice
                   and ~/.pam_environment would become out of sync. */
                throw_error (context, ERROR_FAILED, "not access to HOME yet so language not saved"); <===== 1
                goto out;
        }

        <snip>

out:
        accounts_user_complete_set_language (ACCOUNTS_USER (user), context); <===== 2
}
```

If `user_HOME_available` returns an error, then `throw_error` is called at 1 to send an `ERROR` message, but a regular `METHOD_RETURN` is also sent at 2. This is incorrect D-Bus protocol, but the more serious problem is that it causes a use-after-free because both `throw_error` and `accounts_user_complete_set_language` decrease the reference count on `context`. In other words, `context` is freed by `throw_error` and a UAF occurs in `accounts_user_complete_set_language`.

An attacker can trigger the bug above by causing `user_HOME_available` to fail, which they can do by deleting all the files from their home directory. But there are other incorrect uses of `throw_error` in `user.c` which are less inconvenient to trigger. For example, this command triggers a call to `throw_error` in `user_update_environment` due to the invalid characters in the string.

```bash
dbus-send --system --print-reply --dest=org.freedesktop.Accounts /org/freedesktop/Accounts/User`id -u` org.freedesktop.Accounts.User.SetLanguage string:'**'
```

On Ubuntu 23.04, the above command causes `accounts-daemon` to crash with a `SIGSEGV`. But on Ubuntu 22.04 LTS it doesn't cause any visible harm. The difference is due to a recent [change in GLib's](https://gitlab.gnome.org/GNOME/glib/-/commit/69e9ba80e2f4d2061a1a68d72bae1c32c1e4f8fa) memory allocation: older versions of GLib used the "slice" allocator, but newer version uses the system allocator. The system allocator trashes the memory when it's freed in a way that causes the use-after-free to trigger a SIGSEGV, whereas the "slice" allocator doesn't trash the memory so the UAF goes unnoticed.

#### Impact

Exploitation is likely to be difficult, but this bug could potentially enable a local unprivileged attacker to gain root privileges.

#### Remediation

Always return immediately after calling `throw_error`. For example, it is done correctly in `user_change_background_file_authorized_cb`:

```c
if (type != G_FILE_TYPE_REGULAR) {
        g_debug ("not a regular file\n");
        throw_error (context, ERROR_FAILED, "file '%s' is not a regular file", filename);
        return;
}
```

## GitHub Security Advisories

We recommend you create a private [GitHub Security Advisory](https://help.github.com/en/github/managing-security-vulnerabilities/creating-a-security-advisory) for this finding. This also allows you to invite the GHSL team to collaborate and further discuss this finding in private before it is [published](https://help.github.com/en/github/managing-security-vulnerabilities/publishing-a-security-advisory).

## Credit

This issue was discovered and reported by GHSL team member [@kevinbackhouse (Kevin Backhouse)](https://github.com/kevinbackhouse).

## Contact

You can contact the GHSL team at `<email address hidden>`, please include a reference to `GHSL-2023-139` in any communication regarding this issue.

## Disclosure Policy

This report is subject to our [coordinated disclosure policy](https://securitylab.github.com/advisories#policy).

[Marc Deslauriers (mdeslaur)]

Hi Kevin,

Thanks for reporting this issue!

I see the multiple instances of the problematic code were added by the Ubuntu-specific 0010-set-language.patch patch.

We'll investigate this issue shortly and will get back to you with a proposed fix, a proposed CRD, and a CVE number.

[Mark Esler (eslerm)]

Please refer to this issue as CVE-2023-3297.

Thank you for your report!

[Marc Deslauriers (mdeslaur)]

Here is a proposed debdiff for mantic for review by the desktop team

[Robert Ancell (robert-ancell)]

I applied the debdiff and reviewed that changes to src/user.c - these look good, thanks!

[Marc Deslauriers (mdeslaur)]

Thanks for the review Robert!

[Marc Deslauriers (mdeslaur)]

I propose a CRD of 2023-06-28 12:00:00 UTC. Unless anyone objects, I will be publishing updates for this issue at that time.

Thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 22.08.8-1ubuntu7.1

---------------
accountsservice (22.08.8-1ubuntu7.1) lunar-security; urgency=medium

  * SECURITY UPDATE: use-after-free in user.c (LP: #2024182)
    - debian/patches/0010-set-language.patch: updated to properly return
      from functions after throw_error() has been called.
    - CVE-2023-3297

 -- Marc Deslauriers <email address hidden> Tue, 20 Jun 2023 07:23:47 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 22.07.5-2ubuntu1.4

---------------
accountsservice (22.07.5-2ubuntu1.4) jammy-security; urgency=medium

  * SECURITY UPDATE: use-after-free in user.c (LP: #2024182)
    - debian/patches/0010-set-language.patch: updated to properly return
      from functions after throw_error() has been called.
    - CVE-2023-3297

 -- Marc Deslauriers <email address hidden> Tue, 20 Jun 2023 07:25:34 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 0.6.55-0ubuntu12~20.04.6

---------------
accountsservice (0.6.55-0ubuntu12~20.04.6) focal-security; urgency=medium

  * SECURITY UPDATE: use-after-free in user.c (LP: #2024182)
    - debian/patches/0010-set-language.patch: updated to properly return
      from functions after throw_error() has been called.
    - CVE-2023-3297

 -- Marc Deslauriers <email address hidden> Tue, 20 Jun 2023 07:26:26 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 22.08.8-1ubuntu1.1

---------------
accountsservice (22.08.8-1ubuntu1.1) kinetic-security; urgency=medium

  * SECURITY UPDATE: use-after-free in user.c (LP: #2024182)
    - debian/patches/0010-set-language.patch: updated to properly return
      from functions after throw_error() has been called.
    - CVE-2023-3297

 -- Marc Deslauriers <email address hidden> Tue, 20 Jun 2023 07:24:53 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package accountsservice - 23.13.9-2ubuntu2

---------------
accountsservice (23.13.9-2ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: use-after-free in user.c (LP: #2024182)
    - debian/patches/0010-set-language.patch: updated to properly return
      from functions after throw_error() has been called.
    - CVE-2023-3297

 -- Marc Deslauriers <email address hidden> Wed, 28 Jun 2023 11:10:09 -0400