CVE-2024-5148 Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate
A flaw in GNOME Remote Desktop allows local attackers to expose RDP TLS certificates and hijack client connections during session transitions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-5148?
CVE-2024-5148 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 2 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.
Weakness: CWE-488
Which versions are affected by CVE-2024-5148?
Linux distribution packages (1)
gnome-remote-desktop openSUSE:Tumbleweed | All versions | 46.2-1.1 |
How do I fix CVE-2024-5148?
Apply the vendor's patch.
Is CVE-2024-5148 being exploited?
There is no known exploitation of CVE-2024-5148 in the wild and no public exploit code.
Sources
Also known as GHSA-vj28-g7j2-2wxf, UBUNTU-CVE-2024-5148, USN-6785-1, openSUSE-SU-2024:14002-1.