Security features bypass in gnome-shell - CVE-2024-36472

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU94782

Security features bypass in gnome-shell - CVE-2024-36472

Published: July 26, 2024


Vulnerability identifier: #VU94782
CSH Severity: Medium
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-36472
CWE-ID: CWE-254
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to missing access restrictions in portal helper, which can be launched automatically without user confirmation based on network responses provided by an adversary in the local network (e.g. WI-Fi). A remote attacker can consume system resources or perform other actions depending on the JavaScript code's behavior.


Affected software

gnome-shell
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Workstation Extension 12
Desktop Applications Module
openSUSE Leap
Ubuntu
openEuler
gnome-shell-calendar
gnome-shell-debugsource
gnome-shell-devel
gnome-shell-debuginfo
gnome-shell-browser-plugin-debuginfo
gnome-shell-browser-plugin
gnome-shell
gnome-shell-lang
gnome-shell-calendar-debuginfo
gnome-shell (Ubuntu package)
gnome-shell-extensions (Red Hat package)
gnome-shell-extension-gesture-inhibitor
gnome-shell-extension-apps-menu
gnome-shell-extension-drive-menu
gnome-shell-extension-desktop-icons
gnome-shell-extension-dash-to-panel
gnome-shell-extension-dash-to-dock
gnome-shell-extension-common
gnome-shell-extension-classification-banner
gnome-shell-extension-auto-move-windows
gnome-shell-extension-workspace-indicator
gnome-shell-extension-heads-up-display
gnome-shell-extension-launch-new-instance
gnome-shell-extension-native-window-placement
gnome-shell-extension-panel-favorites
gnome-shell-extension-places-menu
gnome-shell-extension-screenshot-window-sizer
gnome-shell-extension-systemMonitor
gnome-shell-extension-top-icons
gnome-shell-extension-updates-dialog
gnome-shell-extension-user-theme
gnome-shell-extension-window-list
gnome-shell-extension-windowsNavigator
gnome-shell-extensions-doc
gnome-classic-session
gnome-shell (Red Hat package)
gnome-extensions-debuginfo
gnome-extensions
gnome-shell-help

How to mitigate CVE-2024-36472

Install updates from vendor's website.

gnome-shell - update to 45.8
gnome-shell-calendar - addressed in versions 3.20.4-77.28.1, 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell-debugsource - addressed in versions 3.20.4-77.28.1, 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell-devel - addressed in versions 3.20.4-77.28.1, 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell-debuginfo - addressed in versions 3.20.4-77.28.1, 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell-browser-plugin-debuginfo - update to 3.20.4-77.28.1
gnome-shell-browser-plugin - update to 3.20.4-77.28.1
gnome-shell - addressed in versions 3.20.4-77.28.1, 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell-lang - addressed in versions 3.20.4-77.28.1, 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell-calendar-debuginfo - addressed in versions 3.20.4-77.28.1, 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell (Ubuntu package) - addressed in versions 3.36.9-0ubuntu0.20.04.4, 42.9-0ubuntu2.2, 46.0-0ubuntu6~24.04.3
gnome-shell-extensions (Red Hat package) - update to 40.7-19.el9
gnome-shell-extension-gesture-inhibitor - update to 40.7-19.0.1
gnome-shell-extension-apps-menu - update to 40.7-19.0.1
gnome-shell-extension-drive-menu - update to 40.7-19.0.1
gnome-shell-extension-desktop-icons - update to 40.7-19.0.1
gnome-shell-extension-dash-to-panel - update to 40.7-19.0.1
gnome-shell-extension-dash-to-dock - update to 40.7-19.0.1
gnome-shell-extension-common - update to 40.7-19.0.1
gnome-shell-extension-classification-banner - update to 40.7-19.0.1
gnome-shell-extension-auto-move-windows - update to 40.7-19.0.1
gnome-shell-extension-workspace-indicator - update to 40.7-19.0.1
gnome-shell-extension-heads-up-display - update to 40.7-19.0.1
gnome-shell-extension-launch-new-instance - update to 40.7-19.0.1
gnome-shell-extension-native-window-placement - update to 40.7-19.0.1
gnome-shell-extension-panel-favorites - update to 40.7-19.0.1
gnome-shell-extension-places-menu - update to 40.7-19.0.1
gnome-shell-extension-screenshot-window-sizer - update to 40.7-19.0.1
gnome-shell-extension-systemMonitor - update to 40.7-19.0.1
gnome-shell-extension-top-icons - update to 40.7-19.0.1
gnome-shell-extension-updates-dialog - update to 40.7-19.0.1
gnome-shell-extension-user-theme - update to 40.7-19.0.1
gnome-shell-extension-window-list - update to 40.7-19.0.1
gnome-shell-extension-windowsNavigator - update to 40.7-19.0.1
gnome-shell-extensions-doc - update to 40.7-19.0.1
gnome-classic-session - update to 40.7-19.0.1
gnome-shell (Red Hat package) - addressed in versions 40.10-19.el9_4, 40.10-21.el9
gnome-shell - update to 40.10-21
gnome-extensions-debuginfo - update to 41.9-150400.3.11.1
gnome-extensions - addressed in versions 41.9-150400.3.11.1, 45.3-150600.5.6.1
gnome-shell - update to 44.6-3
gnome-shell-debuginfo - update to 44.6-3
gnome-shell-debugsource - update to 44.6-3
gnome-shell-help - update to 44.6-3

External References

Related Security Bulletins