Logo
›
›vulnerability›CVE-2024-34397
Name
CVE-2024-34397
Source
NVD ( link)Debian ( link)
Description
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.
CWEs
CWE-290
Published Date
Updated Date
Workaround
-
Advisories
https://gitlab.gnome.org/GNOME/glib/-/issues/3268Exploit
https://lists.debian.org/debian-lts-announce/2024/05/msg00008.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/Mailing List
https://security.netapp.com/advisory/ntap-20240531-0008/Third Party Advisory
https://www.openwall.com/lists/oss-security/2024/05/07/5Mailing List
https://gitlab.gnome.org/GNOME/glib/-/issues/3268Exploit
https://lists.debian.org/debian-lts-announce/2024/05/msg00008.htmlMailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/Mailing List
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/Mailing List
https://security.netapp.com/advisory/ntap-20240531-0008/Third Party Advisory
https://www.openwall.com/lists/oss-security/2024/05/07/5Mailing List

Analysis#

Affected Component
Analysis
glib-2.0
Patched

Vulnerability Ratings#

5.2
CVSSv31
NaN
other

Others affected components#

Name
Project
Project Version
Version
Status
glib-2.0
yocto
master
2.88.1
Not Affected
glib-2.0
yocto
scarthgap
2.78.6
Not Affected

Resolved with patches#

glib-2.0 (yocto:kirkstone)

#
Title
Author
Resolve
1
gdbusconnection: Move SignalData, SignalSubscriber
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
2
gdbus-proxy test: Wait before asserting name owner has
Simon McVittie <smcv@debian.org>
CVE-2024-34397
3
tests: Ensure that unsubscribing with GetNameOwner
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
4
tests: Add test coverage for signals that match the
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
5
gdbusconnection: Factor out add_signal_data()
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
6
gdbusconnection: Make a backport of g_set_str()
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
7
gdbusconnection: Stop storing sender_unique_name in
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
8
tests: Add a test-case for what happens if a unique
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
9
gdbus: Track name owners for signal subscriptions
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
10
gdbusconnection: Don't deliver signals if the sender
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
11
tests: Add support for subscribing to signals from a
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
12
tests: Add a test for matching by two well-known names
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
13
gdbusmessage: Cache the arg0 value
Philip Withnall <pwithnall@gnome.org>
CVE-2024-34397
14
tests: Add a data-driven test for signal subscriptions
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
15
gdbusconnection: Factor out signal_data_new_take()
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
16
gdbusconnection: Factor out
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
17
tests: Add a test for signal filtering by well-known
Simon McVittie <smcv@collabora.com>
CVE-2024-34397
18
gdbusprivate: Add symbolic constants for the message
Simon McVittie <smcv@collabora.com>
CVE-2024-34397