Executive brief
A vulnerability in the malcontent parental control system, used in GNOME desktop environments, allows any local user to exhaust system disk space. By repeatedly sending specific requests to the system's timer service, an attacker can fill up the storage used for application usage logs. This can lead to a denial-of-service condition where the system or other applications fail to function due to lack of available disk space.
Technical details
The vulnerability exists in the RecordUsage D-Bus method within the malcontent-timerd component of malcontent 0.14.0. The service fails to implement proper rate limiting or storage quotas for usage entries submitted via D-Bus. A local attacker, including low-privileged users like 'nobody', can invoke the org.freedesktop.MalcontentTimer1.Child.RecordUsage method in a loop to create an unlimited number of application usage entries. These entries are stored in GVDB files within /var/lib/malcontent-timerd/store/, eventually consuming all available space on the /var partition. As of the advisory date, no upstream patch is available, though suggested mitigations include restricting the D-Bus method to active local sessions and implementing per-user entry limits.
Affected products
- GNOME malcontent 0.14.0
Timeline
- 2026-02-18: disclosed: Private report to upstream GitLab
- 2026-05-05: advisory: SUSE Bugzilla bug made public
- 2026-05-11: advisory: Public security report published by SUSE Security Team