What’s Vulnerable › Vulnerabilities
CVE-2024-36041
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-07-05 · updated 2026-06-17
- Weakness: CWE-613
Description
KSmserver in KDE Plasma Workspace (aka plasma-workspace) before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the session-restore feature to execute arbitrary code as the victim (on the next boot) via earlier use of the /tmp directory.
Affected products
- KDE Plasma Workspace: before 5.27.11.1; from 6.0.0.0 before 6.0.5.1 — fixed in 5.27.11.1, 6.0.5.1
How to fix
Upgrade to a fixed version: KDE Plasma Workspace 5.27.11.1, 6.0.5.1. Check the vendor advisory for mitigations.
References
- https://github.com/KDE/plasma-workspace/tags
- https://invent.kde.org/plasma/plasma-workspace/
- https://kde.org/info/security/advisory-20240531-1.txt
- https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html
- https://github.com/KDE/plasma-workspace/tags
- https://invent.kde.org/plasma/plasma-workspace/
- https://kde.org/info/security/advisory-20240531-1.txt
- https://lists.debian.org/debian-lts-announce/2024/06/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43YGQJGB5I33UBRY2OHXTPXIEESZLZ6N/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNOZWSWXAR6EM3VIUJRSAI3L4QPURQPC/
- https://www.x.org/releases/X11R7.7/doc/libSM/xsmp.html
Get alerted when CVE-2024-36041 or the next vulnerability affects your stack