Junglewise Threat Intelligence

CVE-2024-34397: GNOME GLib spoofing vulnerability in GDBus signal subscriptions

CVE-2024-34397 · Severity: medium · CVSS 5.2 · Published 2024-05-07

Technologies: Gnome Glib. Vendors: Gnome, Debian.

Executive brief

A security flaw was found in GLib, a core library used by many Linux applications to communicate with system services like NetworkManager. On shared computers, a local user could send fake signals that appear to come from these trusted system services. This could cause applications to perform incorrect actions or crash, depending on how they rely on those system signals.

Technical details

A vulnerability exists in GLib's GDBusConnection where signal subscriptions for well-known names (e.g., com.example.Foo) fail to verify the actual sender's identity. When a client subscribes to a signal, GLib creates a match rule but does not adequately validate that incoming signals originate from the current owner of that well-known name. A local attacker on a shared system can send spoofed unicast D-Bus signals that the GDBus client will wrongly interpret as originating from a trusted system service like NetworkManager or systemd-logind. This is caused by the library's failure to track name owners for signal subscriptions and verify them during signal distribution. The issue is fixed in GLib versions 2.78.5, 2.80.1, and 2.81.0.

Affected products

  • GNOME GLib < 2.78.5, 2.79.x, 2.80.x < 2.80.1
  • Debian glib2.0 2.58.3-2+deb10u6
  • Fedora Project Fedora 39, 40

Timeline

  • 2024-05-07: disclosed: Vulnerability disclosed by Alicia Boya García
  • 2024-05-07: advisory: NVD entry published
  • 2024-05-13: patched: Debian released security update DLA-3814-1

References

Related threats