CVE-2024-38394

Publication date 16 June 2024

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

** DISPUTED ** Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel’s underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of “a new feature, not a CVE.”

Read the notes from the security team

Status

Package Ubuntu Release Status
gnome-settings-daemon 24.04 LTS noble
Not affected
23.10 mantic Ignored end of life, was deferred [2024-07-18]
22.04 LTS jammy
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

mdeslaur

as of 2024-07-18, there is no fix from gnome-settings-daemon as they don’t believe that is the proper place to address this issue. Deferring this CVE for now.