CVE-2024-5148

Published: Sep 2, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and key can be exposed to unauthorized users. This flaw allows a malicious user on the system to take control of the RDP client connection during the login screen-to-user session transition.

Related CWEs

CWE-488

Exposure of Data Element to Wrong Session

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

References (3)

https://access.redhat.com/security/cve/CVE-2024-5148

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2282003

Source: secalert@redhat.com

https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/196

Source: secalert@redhat.com

Timeline

No history available yet.