CVE-2024-36041

KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/KDE/plasma-workspace/tags	Release Notes
https://invent.kde.org/plasma/plasma-workspace/	Product
https://kde.org/info/security/advisory-20240531-1.txt	Vendor Advisory
https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:kde:plasma-workspace::::::::
	cpe:2.3:a:kde:plasma-workspace::::::::

History

No history.

Information

Published : 2024-07-05 02:15

Updated : 2024-07-09 16:22

NVD link : CVE-2024-36041

Mitre link : CVE-2024-36041

CVE.ORG link : CVE-2024-36041

JSON object : View

Products Affected

kde

plasma-workspace

CWE

NVD-CWE-noinfo CWE-613

Insufficient Session Expiration

{"id": "CVE-2024-36041", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.3}]}, "published": "2024-07-05T02:15:10.000", "references": [{"url": "https://github.com/KDE/plasma-workspace/tags", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://invent.kde.org/plasma/plasma-workspace/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://kde.org/info/security/advisory-20240531-1.txt", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory."}, {"lang": "es", "value": "KSmserver en KDE Plasma Workspace (tambi\u00e9n conocido como plasma-workspace) anterior a 5.27.11.1 y 6.x anterior a 6.0.5.1 permite conexiones a trav\u00e9s de ICE basadas exclusivamente en el host, es decir, se aceptan todas las conexiones locales. Esto permite que otro usuario en la misma m\u00e1quina obtenga acceso al administrador de sesi\u00f3n, por ejemplo, use la funci\u00f3n de restauraci\u00f3n de sesi\u00f3n para ejecutar c\u00f3digo arbitrario como v\u00edctima (en el siguiente inicio) mediante el uso anterior del directorio /tmp."}], "lastModified": "2024-07-09T16:22:37.687", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kde:plasma-workspace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34F84782-CEA1-4797-A2C4-C575F10D1EDC", "versionEndExcluding": "5.27.11.1"}, {"criteria": "cpe:2.3:a:kde:plasma-workspace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89B45E9D-1DB8-486E-9BFA-2D651B9C8685", "versionEndExcluding": "6.0.5.1", "versionStartIncluding": "6.0.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}