Log in Start free

Vulnerability · Published Jun 15, 2024 · Assigned by mitre

CVE-2024-38394

Medium 4.3

In plain English

A medium-severity security flaw in the gnome-settings-daemon package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 75.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gnome-settings-daemonno fix listedDEBIAN-CVE-2024-38394
Debian:13gnome-settings-daemonno fix listedDEBIAN-CVE-2024-38394
Debian:14gnome-settings-daemonno fix listedDEBIAN-CVE-2024-38394

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References