CVE-2024-38394

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected software

No affected versions have been published.

Timeline

Published: Jun 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-383959.8In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is no CVE-2024-383969.8An issue was discovered in iTerm2 3.5.x before 3.5.2. Unfiltered use of an escape sequence to report a window title, in combination with the CVE-2024-383977.5Transient DOS while parsing probe response and assoc response frame.CVE-2024-383997.8Memory corruption while processing user packets to generate page faults.CVE-2024-38407.5Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation res CVE-2024-384017.8Memory corruption while processing concurrent IOCTL calls.CVE-2024-384027.8Memory corruption while processing IOCTL call for getting group info.CVE-2024-384036.5Transient DOS while parsing BTM ML IE when per STA profile is not included.CVE-2024-384047.5Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.CVE-2024-384056.5Transient DOS while processing the CU information from RNR IE.CVE-2024-384067.0Memory corruption while handling IOCTL calls in JPEG Encoder driver.CVE-2024-384077.0Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.