CVE-2021-3939: Accountsservice Use-After-Free Flaw

CVE-2021-3939 Overview

CVE-2021-3939 is a memory corruption vulnerability affecting Ubuntu-specific modifications to the accountsservice package. The flaw exists in the patch file debian/patches/0010-set-language.patch, where the fallback_locale variable, which points to static storage, is incorrectly freed in the user_change_language_authorized_cb function. This double-free condition is reachable via the SetLanguage D-Bus function, potentially allowing a local attacker with low privileges to corrupt memory and achieve code execution or privilege escalation.

Critical Impact

Local attackers can exploit this double-free vulnerability through the D-Bus SetLanguage function to corrupt memory, potentially achieving privilege escalation or arbitrary code execution on affected Ubuntu systems.

Affected Products

• Canonical accountsservice (versions prior to 0.6.55-0ubuntu12~20.04.5, 0.6.55-0ubuntu13.3, 0.6.55-0ubuntu14.1)
• Ubuntu Linux 20.04 LTS
• Ubuntu Linux 21.04
• Ubuntu Linux 21.10

Discovery Timeline

• 2021-11-17 - CVE CVE-2021-3939 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3939

Vulnerability Analysis

This vulnerability represents a classic double-free memory corruption issue introduced through Ubuntu-specific patching of the upstream accountsservice package. The flaw is categorized under CWE-763 (Release of Invalid Pointer or Reference) and CWE-590 (Free of Memory not on the Heap).

The root of the problem lies in how the Ubuntu patch handles the fallback_locale variable. This variable is designed to point to static storage—memory that should not be deallocated during program execution. However, due to improper memory management in the patched code, the free() function is called on this statically allocated memory within the user_change_language_authorized_cb callback function.

When static memory is freed and subsequently accessed or freed again, it results in undefined behavior that attackers can potentially leverage for memory corruption attacks. The vulnerability requires local access and low privileges to exploit, as the attacker must be able to invoke the SetLanguage D-Bus method.

Root Cause

The vulnerability stems from improper memory management in Ubuntu's custom patch (debian/patches/0010-set-language.patch) to the accountsservice package. The fallback_locale variable is assigned to point to static storage, which by definition should persist for the lifetime of the program. The patch incorrectly attempts to free this static memory in the user_change_language_authorized_cb function, violating fundamental memory management principles. This results in a double-free condition when the memory is later accessed or freed again, leading to heap corruption.

Attack Vector

The attack is executed locally through the D-Bus inter-process communication system. An authenticated local user can trigger the vulnerability by calling the SetLanguage D-Bus method on the accountsservice. The attack flow is as follows:

1. The attacker authenticates as a local user with standard privileges
2. The attacker invokes the SetLanguage D-Bus function with crafted parameters
3. The accountsservice processes the request and enters the user_change_language_authorized_cb callback
4. The vulnerable code path frees the statically allocated fallback_locale memory
5. Subsequent memory operations corrupt the heap, potentially allowing the attacker to gain elevated privileges or execute arbitrary code

The vulnerability does not require user interaction and can be exploited reliably once the attacker has local access to the system.

Detection Methods for CVE-2021-3939

Indicators of Compromise

• Unusual crashes or segmentation faults in the accounts-daemon process
• Unexpected D-Bus activity targeting the SetLanguage method of accountsservice
• Memory corruption indicators in system logs related to accountsservice
• Core dumps from the accounts-daemon showing heap corruption patterns

Detection Strategies

• Monitor system logs for accountsservice crashes or unexpected terminations
• Implement D-Bus method call auditing to track SetLanguage invocations
• Deploy memory corruption detection tools that can identify double-free conditions
• Use SentinelOne's behavioral AI to detect exploitation attempts targeting system services

Monitoring Recommendations

• Enable detailed logging for D-Bus method calls on production systems
• Configure crash dump collection for the accounts-daemon process
• Set up alerts for repeated accountsservice restarts or failures
• Monitor for privilege escalation attempts following accountsservice interaction

How to Mitigate CVE-2021-3939

Immediate Actions Required

• Update accountsservice to the patched versions immediately
• For Ubuntu 20.04 LTS: upgrade to version 0.6.55-0ubuntu12~20.04.5 or later
• For Ubuntu 21.04: upgrade to version 0.6.55-0ubuntu13.3 or later
• For Ubuntu 21.10: upgrade to version 0.6.55-0ubuntu14.1 or later
• Verify the update was applied using apt list --installed | grep accountsservice

Patch Information

Canonical has released patched versions of accountsservice that address this double-free vulnerability. The fix corrects the memory management logic in the user_change_language_authorized_cb function to prevent freeing of statically allocated memory. Detailed information is available in the Ubuntu Security Notice USN-5149-1. Additional technical details can be found in the Launchpad Bug Report.

Workarounds

• Restrict D-Bus access to the accountsservice for untrusted local users if patching is not immediately possible
• Implement strict access controls to limit which users can invoke SetLanguage methods
• Consider using AppArmor or SELinux policies to further constrain accountsservice capabilities
• Monitor for exploitation attempts using endpoint detection solutions while awaiting patch deployment

# Update accountsservice on Ubuntu systems
sudo apt update
sudo apt install --only-upgrade accountsservice

# Verify the installed version
dpkg -l | grep accountsservice