CVE-2024-36472: GNOME Shell RCE Vulnerability

CVE-2024-36472 Overview

A vulnerability exists in GNOME Shell through version 45.7 where the portal helper component can be automatically launched without user confirmation based on network responses. This flaw allows an adversary who controls a local Wi-Fi network to trigger the portal helper and subsequently load untrusted JavaScript code, potentially leading to resource consumption or other impacts depending on the malicious JavaScript code's behavior.

Critical Impact

An attacker on an adjacent network can automatically launch the GNOME Shell portal helper to execute untrusted JavaScript, enabling denial of service through resource exhaustion without requiring any user interaction.

Affected Products

• GNOME Shell versions through 45.7

Discovery Timeline

• 2024-05-28 - CVE-2024-36472 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-36472

Vulnerability Analysis

This vulnerability is classified under CWE-346 (Origin Validation Error), indicating that GNOME Shell fails to properly validate the origin of network responses before taking security-relevant actions. The portal helper functionality, designed to assist users with captive portal authentication on public Wi-Fi networks, lacks adequate verification of whether the network responses triggering its launch are legitimate.

The attack is exploitable from an adjacent network position, meaning an attacker must be on the same network segment as the victim. The vulnerability requires no privileges or user interaction, making it particularly dangerous in public Wi-Fi scenarios where users expect some level of network-assisted portal functionality.

Root Cause

The root cause lies in the Origin Validation Error within GNOME Shell's portal helper implementation. The component automatically responds to certain network responses that indicate a captive portal is present, without verifying whether these responses originate from a legitimate network authority. This design flaw allows any entity on the adjacent network to craft malicious network responses that trigger the portal helper to launch and load arbitrary JavaScript content.

Attack Vector

The attack requires the adversary to have control over the local Wi-Fi network or be in a position to inject malicious network responses (such as through ARP spoofing or rogue access point attacks). When a victim's GNOME Shell desktop environment detects what appears to be a captive portal, it automatically launches the portal helper without user confirmation. The portal helper then loads and executes JavaScript code specified by the attacker-controlled network responses.

This adjacent network attack vector is particularly concerning in environments such as:

• Coffee shops and public Wi-Fi hotspots
• Hotel and airport networks
• Conference venues
• Shared office networks

The attacker can leverage this to cause denial of service through resource exhaustion or potentially chain with other vulnerabilities depending on the JavaScript execution context.

Detection Methods for CVE-2024-36472

Indicators of Compromise

• Unexpected portal helper process launches when not connecting to known captive portal networks
• Unusual JavaScript execution or resource consumption associated with GNOME Shell processes
• Network traffic anomalies indicating captive portal response injection
• Abnormal CPU or memory usage by gnome-shell or related portal helper components

Detection Strategies

• Monitor for unexpected launches of the portal helper component (/usr/libexec/gnome-session-check-accelerated and related portal services)
• Implement network monitoring to detect suspicious captive portal redirect responses on trusted networks
• Deploy endpoint detection to identify abnormal JavaScript execution patterns within GNOME Shell contexts
• Review system logs for portal helper activity that doesn't correlate with legitimate network transitions

Monitoring Recommendations

• Enable verbose logging for GNOME Shell portal helper components to track activation events
• Implement network-level monitoring to detect rogue captive portal responses
• Configure endpoint protection to alert on unusual resource consumption patterns in desktop environment processes
• Correlate network connection events with portal helper launches to identify suspicious activations

How to Mitigate CVE-2024-36472

Immediate Actions Required

• Disable automatic captive portal detection in GNOME Shell settings if not required for your environment
• Avoid connecting to untrusted Wi-Fi networks on systems running vulnerable GNOME Shell versions
• Apply vendor patches as they become available from your Linux distribution
• Consider using VPN connections on public networks to prevent adjacent network attacks

Patch Information

For detailed information about the vulnerability and patch status, refer to the GNOME Shell Issue Discussion on the official GNOME GitLab repository. Users should monitor their Linux distribution's security advisories for updated packages that address this vulnerability.

Workarounds

• Disable the captive portal helper functionality by configuring NetworkManager settings to prevent automatic portal detection
• Use enterprise network configurations that bypass captive portal detection mechanisms
• Implement network segmentation to limit exposure to potential attackers on shared network segments
• Consider alternative desktop environments for high-security scenarios until patches are applied

# Disable captive portal detection in NetworkManager
# Add to /etc/NetworkManager/conf.d/20-connectivity.conf
[connectivity]
enabled=false