CVE-2020-35512: 
NixOS vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2020-35512) was discovered in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30. The vulnerability occurs when a system has multiple usernames sharing the same UID and a set of policy rules references these usernames (NVD).

The vulnerability is classified as a use-after-free (CWE-416) flaw where D-Bus may free memory in the heap that is still being used by data structures necessary for other usernames sharing the same UID. The vulnerability has a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability could lead to a crash resulting in denial of service or other undefined behaviors, potentially including incorrect authorization decisions. Like Unix filesystems, D-Bus' model of identity cannot distinguish between users of different names with the same numeric uid, making this configuration inadvisable on systems where D-Bus will be used (Gentoo Bug, Red Hat Bugzilla).

The vulnerability requires local access with low complexity and low privileges to exploit. No user interaction is needed for exploitation. Due to these factors and the potential impact, Red Hat has rated this vulnerability as having Low Impact, noting that users with the same UID are treated as the same user in Linux (Red Hat Bugzilla).

The vulnerability has been fixed in multiple versions including D-Bus 1.10.32, 1.12.20, and 1.13.18. Users are advised to update to the fixed versions. Additionally, it is recommended to avoid configurations where multiple users share the same UID on systems where D-Bus is used (Debian Security Tracker).