Vulnerability · Published Jul 5, 2024 · Assigned by mitre
CVE-2024-36041
High 7.3
In plain English
A high-severity security flaw in the plasma-workspace package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | plasma-workspace | 6.0.5.1 | ALPINE-CVE-2024-36041 |
| Alpine:v3.21 | plasma-workspace | 6.0.5.1 | ALPINE-CVE-2024-36041 |
| Alpine:v3.22 | plasma-workspace | 6.0.5.1-r0 | ALPINE-CVE-2024-36041 |
| Alpine:v3.23 | plasma-workspace | 6.0.5.1-r0 | ALPINE-CVE-2024-36041 |
| Alpine:v3.24 | plasma-workspace | 6.0.5.1-r0 | ALPINE-CVE-2024-36041 |
| Debian:12 | plasma-workspace | 4:5.27.5-2+deb12u2 | DSA-5723-1 |
| Debian:12 | plasma-workspace | 4:5.27.5-2+deb12u2 | DEBIAN-CVE-2024-36041 |
| Debian:13 | plasma-workspace | 4:5.27.11.1-1 | DEBIAN-CVE-2024-36041 |
| Debian:14 | plasma-workspace | 4:5.27.11.1-1 | DEBIAN-CVE-2024-36041 |
| Ubuntu:22.04:LTS | plasma-workspace | 4:5.24.7-0ubuntu0.2 | USN-6843-1 |
| Ubuntu:22.04:LTS | plasma-workspace | 4:5.24.7-0ubuntu0.2 | UBUNTU-CVE-2024-36041 |
| Ubuntu:24.04:LTS | plasma-workspace | 4:5.27.11-0ubuntu4.1 | UBUNTU-CVE-2024-36041 |
| Ubuntu:24.04:LTS | plasma-workspace | 4:5.27.11-0ubuntu4.1 | USN-6843-1 |
Affected products (as reported)
Weakness: CWE-613 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://invent.kde.org/plasma/plasma-workspace/
- https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html
- https://github.com/KDE/plasma-workspace/tags
- https://kde.org/info/security/advisory-20240531-1.txt
- https://lists.debian.org/debian-lts-announce/2024/06/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43YGQJGB5I33UBRY2OHXTPXIEESZLZ6N/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNOZWSWXAR6EM3VIUJRSAI3L4QPURQPC/