CVE-2024-38394 - Vulnerability Details - OpenCVE

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00034.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780
https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914
https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags
https://nvd.nist.gov/vuln/detail/CVE-2024-38394
https://pulsesecurity.co.nz/advisories/usbguard-bypass
https://www.cve.org/CVERecord?id=CVE-2024-38394

History

Tue, 12 Nov 2024 21:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-06-15T00:00:00

Updated: 2024-11-12T20:55:53.239Z

Reserved: 2024-06-15T00:00:00

Link: CVE-2024-38394

Vulnrichment

Updated: 2024-08-02T04:12:24.588Z

NVD

Status : Awaiting Analysis

Published: 2024-06-16T00:15:49.380

Modified: 2024-11-21T09:25:35.257

Link: CVE-2024-38394

Redhat

Severity : Moderate

Publid Date: 2024-06-16T00:00:00Z

Links: CVE-2024-38394 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-38394", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-11-12T20:55:53.239Z", "dateReserved": "2024-06-15T00:00:00", "datePublished": "2024-06-15T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-15T23:53:35.056904"}, "descriptions": [{"lang": "en", "value": "Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of \"a new feature, not a CVE.\""}], "tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://pulsesecurity.co.nz/advisories/usbguard-bypass"}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780"}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914"}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-17T15:20:18.364109Z", "id": "CVE-2024-38394", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-12T20:55:53.239Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:24.588Z"}, "title": "CVE Program Container", "references": [{"url": "https://pulsesecurity.co.nz/advisories/usbguard-bypass", "tags": ["x_transferred"]}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780", "tags": ["x_transferred"]}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914", "tags": ["x_transferred"]}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://pulsesecurity.co.nz/advisories/usbguard-bypass", "tags": ["x_transferred"]}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780", "tags": ["x_transferred"]}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914", "tags": ["x_transferred"]}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:24.588Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-38394", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-17T15:20:18.364109Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-17T15:20:27.882Z"}}], "cna": {"tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://pulsesecurity.co.nz/advisories/usbguard-bypass"}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780"}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914"}, {"url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags"}], "descriptions": [{"lang": "en", "value": "Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of \"a new feature, not a CVE.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-15T23:53:35.056904"}}}, "cveMetadata": {"cveId": "CVE-2024-38394", "state": "PUBLISHED", "dateUpdated": "2024-11-12T20:55:53.239Z", "dateReserved": "2024-06-15T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-06-15T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cveTags": [{"sourceIdentifier": "cve@mitre.org", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of \"a new feature, not a CVE.\""}, {"lang": "es", "value": "Las discrepancias en la interpretaci\u00f3n de la pol\u00edtica de autorizaci\u00f3n USB entre el Daemon de configuraci\u00f3n de GNOME (GSD) hasta 46.0 y la l\u00f3gica de coincidencia de dispositivos subyacente del kernel de Linux permiten que un atacante f\u00edsicamente cercano acceda a algunas funciones USB del kernel de Linux no deseadas, como m\u00f3dulos del kernel espec\u00edficos de dispositivos USB e implementaciones de sistemas de archivos. NOTA: el proveedor de GSD indica que la consideraci\u00f3n de una mitigaci\u00f3n para esto dentro de GSD ser\u00eda en el contexto de \"una nueva caracter\u00edstica, no un CVE\"."}], "id": "CVE-2024-38394", "lastModified": "2024-11-21T09:25:35.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-06-16T00:15:49.380", "references": [{"source": "cve@mitre.org", "url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780"}, {"source": "cve@mitre.org", "url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914"}, {"source": "cve@mitre.org", "url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags"}, {"source": "cve@mitre.org", "url": "https://pulsesecurity.co.nz/advisories/usbguard-bypass"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/issues/780#note_2047914"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gitlab.gnome.org/GNOME/gnome-settings-daemon/-/tags"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://pulsesecurity.co.nz/advisories/usbguard-bypass"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis"}