CVE-2024-36041: High severity KDE plasma-workspace vulnerability
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36041?
CVE-2024-36041 has a medium severity rating as it allows local users to access the session manager.
How do I fix CVE-2024-36041?
To fix CVE-2024-36041, upgrade to KDE Plasma Workspace version 5.27.11.1 or 6.0.5.1 or later.
Who is affected by CVE-2024-36041?
Users of KDE Plasma Workspace versions prior to 5.27.11.1 and 6.x before 6.0.5.1 are affected by CVE-2024-36041.
What impact does CVE-2024-36041 have on security?
CVE-2024-36041 potentially allows unauthorized local access to the session manager, compromising user sessions.
Is CVE-2024-36041 a remote or local vulnerability?
CVE-2024-36041 is a local vulnerability that affects users on the same machine.