# CVE-2024-34397: GNOME GLib spoofing vulnerability in GDBus signal subscriptions

Source: https://junglewise.ai/threats/cve-2024-34397-gnome-glib-spoofing-vulnerability-in-gdbus-signal-subscriptions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-07. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-34397 · Severity: medium · CVSS 5.2 · Published 2024-05-07

A security flaw was found in GLib, a core library used by many Linux applications to communicate with system services like NetworkManager. On shared computers, a local user could send fake signals that appear to come from these trusted system services. This could cause applications to perform incorrect actions or crash, depending on how they rely on those system signals.

Technologies: [Gnome Glib](https://junglewise.ai/threats/technologies/glib). Vendors: [Debian](https://junglewise.ai/threats/vendors/debian), [Gnome](https://junglewise.ai/threats/vendors/gnome).

## Quick answers

**Is CVE-2024-34397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-34397 being exploited in the wild.

**How severe is CVE-2024-34397?** Medium severity, with a CVSS score of 5.2, published 7 May 2024.

**Which products and versions are affected?** Debian Glib2.0 2.58.3-2+deb10u6; Gnome Glib < 2.78.5, 2.79.x, 2.80.x < 2.80.1.

**Is there a fix for CVE-2024-34397?** A patch was published on 2024-05-13: Debian released security update DLA-3814-1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-34397 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2024-34397?** Check whether you run Debian Glib2.0 or Gnome Glib at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in GLib's GDBusConnection where signal subscriptions for well-known names (e.g., com.example.Foo) fail to verify the actual sender's identity. When a client subscribes to a signal, GLib creates a match rule but does not adequately validate that incoming signals originate from the current owner of that well-known name. A local attacker on a shared system can send spoofed unicast D-Bus signals that the GDBus client will wrongly interpret as originating from a trusted system service like NetworkManager or systemd-logind. This is caused by the library's failure to track name owners for signal subscriptions and verify them during signal distribution. The issue is fixed in GLib versions 2.78.5, 2.80.1, and 2.81.0.

## Affected products

- GNOME GLib < 2.78.5, 2.79.x, 2.80.x < 2.80.1
- Debian glib2.0 2.58.3-2+deb10u6
- Fedora Project Fedora 39, 40

## Timeline

- 2024-05-07: disclosed: Vulnerability disclosed by Alicia Boya García
- 2024-05-07: advisory: NVD entry published
- 2024-05-13: patched: Debian released security update DLA-3814-1

## References

- [https://gitlab.gnome.org/GNOME/glib/-/issues/3268](https://gitlab.gnome.org/GNOME/glib/-/issues/3268)
- [https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html](https://lists.debian.org/debian-lts-announce/2024/05/msg00008.html)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IRSFYAE5X23TNRWX7ZWEJOMISLCDSYNS/)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCDY3KA7G7D3DRXYTT46K6LFHS2KHWBH/)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LL6HSJDXCXMLEIJBYV6CPOR4K2NTCTXW/)
- [https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/](https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UNFJHISR4O6VFOHBFWH5I5WWMG37H63A/)
- [https://security.netapp.com/advisory/ntap-20240531-0008/](https://security.netapp.com/advisory/ntap-20240531-0008/)

## Related threats

- [GNOME GLib denial of service in GDBus authentication](https://junglewise.ai/threats/cve-2026-15588-gnome-glib-denial-of-service-in-gdbus-authentication)
- [GNOME GLib out-of-bounds read in D-Bus introspection XML parsing](https://junglewise.ai/threats/cve-2026-58016-gnome-glib-out-of-bounds-read-in-d-bus-introspection-xml-parsing)
- [GLib path traversal in GDBus DBUS_COOKIE_SHA1 authentication](https://junglewise.ai/threats/cve-2026-58015-glib-path-traversal-in-gdbus-dbus-cookie-sha1-authentication)
- [GNOME GLib off-by-one error in g_key_file_get_locale_string_list](https://junglewise.ai/threats/cve-2026-58014-gnome-glib-off-by-one-error-in-g-key-file-get-locale-string-list)
- [GNOME GLib buffer over-read in g_io_channel_read_line_backend](https://junglewise.ai/threats/cve-2026-58013-gnome-glib-buffer-over-read-in-g-io-channel-read-line-backend)