CVE-2024-38394

Publication date 16 June 2024

Last updated 30 May 2025

Ubuntu priority

Cvss 3 Severity Score

** DISPUTED ** Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
gnome-settings-daemon	24.04 LTS noble	Not affected
	23.10 mantic	Ignored end of life, was deferred [2024-07-18]
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected

Notes

mdeslaur

as of 2024-07-18, there is no fix from gnome-settings-daemon as they don't believe that is the proper place to address this issue. Deferring this CVE for now.

Severity score breakdown

Parameter	Value
Base score	4.3 · Medium
Attack vector	Physical
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L