Missing Authorization in plasma-workspace - CVE-2024-36041

Vulnerability identifier: #VU91047

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-36041

CWE-ID: CWE-862

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to missing authorization in the ksmserver component. A local user can use the session restore feature to execute arbitrary code as the user on the next boot.

plasma-workspace
Gentoo Linux
Debian Linux
Slackware Linux
openEuler
plasma-workspace (Debian package)
plasma-workspace
plasma-workspace-geolocation-libs
plasma-workspace-debuginfo
libkworkspace5
plasma-workspace-common
plasma-workspace-wayland
plasma-workspace-libs
plasma-workspace-geolocation
plasma-workspace-debugsource
plasma-workspace-devel
plasma-workspace-x11
plasma-workspace-doc
kde-plasma/plasma-workspace

Install updates from vendor's website.

plasma-workspace - addressed in versions 5.27.11.1, 6.0.5.1
plasma-workspace (Debian package) - addressed in versions 4:5.20.5-6+deb11u1, 4:5.27.5-2+deb12u2
plasma-workspace - update to 5.23.5
plasma-workspace - update to 5.27.10-2
plasma-workspace-geolocation-libs - update to 5.27.10-2
plasma-workspace-debuginfo - update to 5.27.10-2
libkworkspace5 - update to 5.27.10-2
plasma-workspace-common - update to 5.27.10-2
plasma-workspace-wayland - update to 5.27.10-2
plasma-workspace-libs - update to 5.27.10-2
plasma-workspace-geolocation - update to 5.27.10-2
plasma-workspace-debugsource - update to 5.27.10-2
plasma-workspace-devel - update to 5.27.10-2
plasma-workspace-x11 - update to 5.27.10-2
plasma-workspace-doc - update to 5.27.10-2
kde-plasma/plasma-workspace - update to 5.27.11.1

• https://kde.org/info/security/advisory-20240531-1.txt

• Privilege escalation in KDE plasma-workspace
• Gentoo update for KDE Plasma Workspaces
• Debian update for plasma-workspace
• openEuler 24.03 LTS update for plasma-workspace
• Slackware Linux update for plasma-workspace