[Vulnerability Report] phosphor-logging / openpower-pels: Local File Descriptor Leak in getPEL leading to DoS

Hi OpenBMC Security Team,

I would like to report a resource exhaustion vulnerability inside the D-Bus
interfaces of the Platform Event Log (PEL) Manager component in
phosphor-logging.

Overview of the Vulnerability:
A local unprivileged client can trigger a persistent file descriptor leak
inside the `phosphor-log-manager` daemon. By making rapid, consecutive
requests, the client can exhaust the operating system's file descriptor
limits for the process, resulting in a system-wide Denial of Service (DoS)
that prevents the daemon from logging new events or handling management
traffic.

Affected File and Location:
File: extensions/openpower-pels/manager.cpp
Line: 468

Root Cause:
The `getPEL` D-Bus method opens a file descriptor and schedules an
asynchronous file closure task using `sdeventplus::source::Defer` stored in
a single member `std::unique_ptr`:
  _fdCloserEventSource = std::make_unique<sdeventplus::source::Defer>(...);

Because D-Bus permits clients to batch multiple calls within a single
execution cycle, a client can invoke the `getPEL` method multiple times
sequentially before the `sdeventplus` event loop has a chance to run and
dispatch the scheduled callbacks.

Each subsequent `getPEL` call re-assigns the `_fdCloserEventSource`
unique_ptr. When a `sdeventplus::source::Defer` object is destructed or
replaced before its callback fires, it automatically cancels the event. As
a result, the file close callback is permanently dropped, leaking the
previously opened file descriptor.

Proof of Concept:
1. Connect a client to the system D-Bus and target the
`org.open_power.Logging.PEL` service.
2. In a tight loop inside a script, rapidly invoke the `getPEL` method
multiple times on valid logs:
   busctl call org.open_power.Logging.PEL /xyz/openbmc_project/logging
org.open_power.Logging.PEL getPEL u <valid_pel_id>
3. Check the open file handles for the `phosphor-log-manager` daemon:
   ls -l /proc/<daemon_pid>/fd
4. The number of open file descriptors steadily increases and remains open
indefinitely, demonstrating the leak.

Proposed Patch:
Queue the asynchronous event cleanup sources inside a dynamic container
(such as a vector or list) rather than relying on a single, overwritable
unique_ptr:

std::vector<std::unique_ptr<sdeventplus::source::Defer>> _pendingFDClosers;
// ... inside getPEL close scheduling:
_pendingFDClosers.push_back(std::make_unique<sdeventplus::source::Defer>(...));

// Ensure to clean up completed tasks periodically or upon callback
execution.

Legal Name for Attribution: Bhargava Naidu Gulla