Insufficient verification of data authenticity in Gnome GLib - CVE-2024-34397

 

Insufficient verification of data authenticity in Gnome GLib - CVE-2024-34397

Published: May 10, 2024


Vulnerability identifier: #VU89351
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-34397
CWE-ID: CWE-345
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to missing authorization for D-Bus signals. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service.


Affected software

Gnome GLib
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat Enterprise Linux Server - AUS
SUSE Linux Enterprise Workstation Extension 12
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
Fedora
IBM Concert Software
Netcool Operations Insight
IBM Sterling Connect:Direct Web Services
Submariner
Service Interconnect
Multicluster GlobalHub
IBM MQ Operator
Ansible Automation Platform
Red Hat Advanced Cluster Management for Kubernetes
Splunk Operator for Kubernetes Add-on
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
OpenShift Logging
IBM Observability with Instana
Voice Gateway
SmartFabric Storage Software
RecoverPoint for Virtual Machines
IBM Qradar SIEM
IBM Business Automation Manager Open Editions
Total Storage Service Console (TSSC) / TS4500 IMC
SmartFabric OS10
webMethods Managed File Transfer
Business Automation Insights
watsonx Assistant for IBM Cloud Pak for Data
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component
watsonx Assistant Cartridge
IBM supplied MQ Advanced container images
Robotic Process Automation for Cloud Pak
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libgio-fam-debuginfo
libgobject-2_0-0-32bit
libgthread-2_0-0-32bit
libgmodule-2_0-0-32bit
libgio-2_0-0-debuginfo-32bit
libgmodule-2_0-0-debuginfo-32bit
libglib-2_0-0-debuginfo-32bit
libgobject-2_0-0-debuginfo-32bit
libgio-2_0-0-32bit
libglib-2_0-0-32bit
libgthread-2_0-0-debuginfo-32bit
libgio-fam
glib2-debugsource
glib2-devel-static
glib2-lang
glib2-devel-debuginfo
glib2-devel
glib2-tools
libgthread-2_0-0
libgio-2_0-0
libgthread-2_0-0-debuginfo
libglib-2_0-0
glib2-tools-debuginfo
libgobject-2_0-0-debuginfo
libgmodule-2_0-0
libgmodule-2_0-0-debuginfo
libgio-2_0-0-debuginfo
libglib-2_0-0-debuginfo
libgobject-2_0-0
glib2 (Red Hat package)
libglib2.0-bin (Ubuntu package)
libglib2.0-0 (Ubuntu package)
glib2.0 (Debian package)
glib2-debuginfo
glib2-help
glib2
glib2-static
glib2-doc
glib2-tests
glib2-devel-64bit
gio-branding-upstream
glib2-tests-devel
libgthread-2_0-0-64bit
libgobject-2_0-0-32bit-debuginfo
libgio-2_0-0-32bit-debuginfo
glib2-tools-32bit
libgmodule-2_0-0-64bit-debuginfo
glib2-devel-64bit-debuginfo
glib2-tools-64bit
libgmodule-2_0-0-32bit-debuginfo
glib2-devel-32bit
libgthread-2_0-0-64bit-debuginfo
libglib-2_0-0-64bit-debuginfo
libgobject-2_0-0-64bit
libglib-2_0-0-64bit
libgio-2_0-0-64bit
libgobject-2_0-0-64bit-debuginfo
glib2-devel-32bit-debuginfo
libgthread-2_0-0-32bit-debuginfo
glib2-tools-32bit-debuginfo
glib2-tests-devel-debuginfo
libgmodule-2_0-0-64bit
libgio-2_0-0-64bit-debuginfo
glib2-tools-64bit-debuginfo
libglib-2_0-0-32bit-debuginfo
mingw-glib2
dev-libs/glib
mingw-glib2 (Red Hat package)
libglib2.0-0t64 (Ubuntu package)
gio-branding-SLE
gnome-shell
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Container Platform for Windows Containers
OpenShift API for Data Protection (OADP)
Network Observability plugin for the Openshift Console
Red Hat OpenShift Container Platform

How to mitigate CVE-2024-34397

Install updates from vendor's website.

Gnome GLib - addressed in versions 2.78.5, 2.80.1
IBM Concert Software - update to 1.0.5
Voice Gateway - update to 1.0.8.12
Netcool Operations Insight - update to 1.6.15
SmartFabric Storage Software - update to 1.4.3
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
IBM Sterling Connect:Direct Web Services - update to 6.3.0.11 ifix001
IBM Qradar SIEM - update to 7.5.0 Update Pack 13 IF01
IBM Business Automation Manager Open Editions - update to 9.1.1
SmartFabric OS10 - update to 10.5.5.10
Business Automation Insights - addressed in versions 24.0.0.0.5, 24.0.1.0.6, 25.0.0.0.3
Submariner - update to 0.18.5
Red Hat OpenShift Serverless - update to 1
Service Interconnect - addressed in versions 1, 1.4
Multicluster GlobalHub - update to 1.2.1
OpenShift API for Data Protection (OADP) - update to 1.3.4
Network Observability plugin for the Openshift Console - update to 1.6.2
IBM MQ Operator - addressed in versions 2.0.27, 3.2.5
Ansible Automation Platform - update to 2.5
Multicluster Engine for Kubernetes - addressed in versions 2.5.8, 2.6.4, 2.6.7, 2.7.2, 2.7.4
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.10.6, 2.10.8, 2.11.3, 2.11.4, 2.11.7, 2.12.0, 2.12.1, 2.12.3
libgio-fam-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1
libgobject-2_0-0-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgthread-2_0-0-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgmodule-2_0-0-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgio-2_0-0-debuginfo-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1
libgmodule-2_0-0-debuginfo-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1
libglib-2_0-0-debuginfo-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1
libgobject-2_0-0-debuginfo-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1
libgio-2_0-0-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libglib-2_0-0-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgthread-2_0-0-debuginfo-32bit - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1
libgio-fam - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1
glib2-debugsource - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-devel-static - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-lang - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-devel-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-devel - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tools - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgthread-2_0-0 - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgio-2_0-0 - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgthread-2_0-0-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libglib-2_0-0 - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tools-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgobject-2_0-0-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgmodule-2_0-0 - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgmodule-2_0-0-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgio-2_0-0-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libglib-2_0-0-debuginfo - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgobject-2_0-0 - addressed in versions 2.48.2-12.37.1, 2.48.2-12.40.1, 2.62.6-150200.3.18.1, 2.62.6-150200.3.21.1, 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2 (Red Hat package) - addressed in versions 2.56.4-10.el8_4.2, 2.56.4-166.el8_10, 2.68.4-7.el9_2, 2.68.4-14.el9_4.1
libglib2.0-bin (Ubuntu package) - addressed in versions 2.64.6-1~ubuntu20.04.7, 2.72.4-0ubuntu2.3, 2.78.0-2ubuntu0.1, 2.80.0-6ubuntu3.1
libglib2.0-0 (Ubuntu package) - addressed in versions 2.64.6-1~ubuntu20.04.7, 2.72.4-0ubuntu2.3, 2.78.0-2ubuntu0.1
glib2.0 (Debian package) - addressed in versions 2.66.8-1+deb11u2, 2.74.6-2+deb12u1
glib2-devel - addressed in versions 2.66.8-14, 2.72.2-15, 2.78.3-2
glib2-debuginfo - addressed in versions 2.66.8-14, 2.72.2-15, 2.78.3-2
glib2-debugsource - addressed in versions 2.66.8-14, 2.72.2-15, 2.78.3-2
glib2-help - addressed in versions 2.66.8-14, 2.72.2-15, 2.78.3-2
glib2 - addressed in versions 2.66.8-14, 2.72.2-15, 2.78.3-2
glib2-static - addressed in versions 2.68.4-14.0.1, 2.78.3-6
glib2-doc - addressed in versions 2.68.4-14.0.1, 2.78.3-6
glib2-tests - addressed in versions 2.68.4-14.0.1, 2.78.3-6
glib2-devel - addressed in versions 2.68.4-14.0.1, 2.78.3-6
glib2 - addressed in versions 2.68.4-14.0.1, 2.78.3-6
glib2-devel-64bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
gio-branding-upstream - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tests-devel - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgthread-2_0-0-64bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgobject-2_0-0-32bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgio-2_0-0-32bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tools-32bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgmodule-2_0-0-64bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-devel-64bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tools-64bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgmodule-2_0-0-32bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-devel-32bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgthread-2_0-0-64bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libglib-2_0-0-64bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgobject-2_0-0-64bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libglib-2_0-0-64bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgio-2_0-0-64bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgobject-2_0-0-64bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-devel-32bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgthread-2_0-0-32bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tools-32bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tests-devel-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgmodule-2_0-0-64bit - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libgio-2_0-0-64bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-doc - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tools-64bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
libglib-2_0-0-32bit-debuginfo - addressed in versions 2.70.5-150400.3.11.1, 2.70.5-150400.3.14.1, 2.78.6-150600.4.3.1
glib2-tests - addressed in versions 2.72.2-15, 2.78.3-2
glib2-static - addressed in versions 2.72.2-15, 2.78.3-2
glib2 - addressed in versions 2.78.5-1.fc39, 2.78.6-1.fc39, 2.80.1-1.fc40, 2.80.2-1.fc40
mingw-glib2 - addressed in versions 2.78.5-1.fc39, 2.80.1-1.fc40
dev-libs/glib - update to 2.78.6
mingw-glib2 (Red Hat package) - update to 2.78.6-1.el9
libglib2.0-0t64 (Ubuntu package) - update to 2.80.0-6ubuntu3.1
Splunk Operator for Kubernetes Add-on - update to 3.0.0
Red Hat OpenShift Dev Spaces - addressed in versions 3.16.0, 3.17.0
watsonx Assistant for IBM Cloud Pak for Data - update to 4.8.8
OpenShift Virtualization - addressed in versions 4.12.20, 4.13.11
OpenShift Data Foundation (formerly OpenShift Container Storage) - addressed in versions 4.13.12, 4.14.11, 4.16.3
Red Hat OpenShift Container Platform - addressed in versions 4.14.54, 4.15.56, 4.16.15, 4.16.44, 4.17.0
App Connect Enterprise Certified Container - addressed in versions 5.0.22, 12.0.6, 12.6.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.1
watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component - update to 5.1.1
watsonx Assistant Cartridge - update to 5.1.1
OpenShift Logging - addressed in versions 5.8.13, 5.8.14, 5.9.7, 5.9.8
IBM supplied MQ Advanced container images - addressed in versions 9.3.0.21-r2, 9.4.0.5-r2
OpenShift Container Platform for Windows Containers - update to 10.17.0
gio-branding-SLE - update to 15-150600.35.2.1
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.19, 23.0.20
gnome-shell - addressed in versions 45.6-2.fc39, 46.1-2.fc40
IBM Observability with Instana - update to 284

External References

Related Security Bulletins