CVE-2024-5148: gnome-remote-desktop Info Disclosure Flaw

CVE-2024-5148 Overview

CVE-2024-5148 affects the gnome-remote-desktop package, a system daemon that provides Remote Desktop Protocol (RDP) services on GNOME-based Linux systems. The daemon performs inadequate validation of session agents when handling D-Bus methods that transition a client connection from the login screen to a user session. This validation gap exposes the system RDP Transport Layer Security (TLS) certificate and private key to unauthorized local users. An attacker with local access can intercept and take control of an RDP client connection during the login-to-session transition.

The weakness is categorized under CWE-488: Exposure of Data Element to Wrong Session.

Critical Impact
A malicious local user can hijack an in-progress RDP session and access the server's TLS certificate and key, breaking the confidentiality of remote desktop traffic.

Affected Products

GNOME Remote Desktop (gnome-remote-desktop) system daemon
Red Hat Enterprise Linux distributions shipping the affected package
Linux distributions packaging vulnerable GNOME Remote Desktop releases

Discovery Timeline

2024-09-02 - CVE-2024-5148 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5148

Vulnerability Analysis

The gnome-remote-desktop daemon brokers RDP sessions between the system-level login screen (GDM) and the per-user GNOME session. When a remote client connects, the daemon coordinates a handoff using D-Bus methods so that the active session agent transitions from the greeter to the authenticated user.

During this handoff, the daemon does not adequately verify which session agent is permitted to receive the RDP connection context. A local attacker with the ability to register or impersonate a session agent on the D-Bus can request the transition and obtain materials intended for a legitimate agent.

The exposed materials include the system RDP TLS certificate and the corresponding private key. With these in hand, the attacker can decrypt captured RDP traffic, present a valid certificate to clients, and take over the connection during the login-screen-to-user-session transition.

Root Cause

The root cause is missing authorization on D-Bus method calls that govern the session transition. The daemon trusts callers without confirming that the requesting agent legitimately corresponds to the transitioning session, violating the principle that sensitive credentials must remain bound to a single authenticated context.

Attack Vector

Exploitation requires the attacker to have a foothold on the local system as an unprivileged user able to communicate on the relevant D-Bus. The attacker registers or interacts with the gnome-remote-desktop D-Bus interface during an RDP login attempt and requests the session transition. The daemon then surrenders TLS material and connection control to the attacker-supplied agent. While the CVSS attack vector is recorded as Network, exploitation depends on local D-Bus access combined with an incoming RDP login event.

No public proof-of-concept code has been published. Technical details are tracked in GNOME Remote Desktop Issue #196 and the Red Hat advisory.

Detection Methods for CVE-2024-5148

Indicators of Compromise

Unexpected D-Bus name ownership or method calls targeting org.gnome.RemoteDesktop interfaces from non-system accounts.
Unauthorized reads or copies of the gnome-remote-desktop TLS certificate and key files under the daemon's state directory.
RDP sessions that disconnect at the greeter handoff and reconnect under anomalous user contexts.
Local user processes spawning shortly before or during inbound RDP login events on port 3389.

Detection Strategies

Audit D-Bus activity with dbus-monitor or systemd journal filters to flag non-root callers invoking gnome-remote-desktop session-transition methods.
Enable Linux auditd rules on the gnome-remote-desktop credential paths to log read access by unexpected UIDs.
Correlate inbound RDP connection events with local process creation events on the same host to surface co-located attacker activity.

Monitoring Recommendations

Monitor installed package versions of gnome-remote-desktop against vendor-fixed releases and alert on hosts running outdated builds.
Track TLS certificate fingerprints presented to RDP clients and alert when a host begins serving a certificate from an unexpected source.
Log and review all interactive logons preceded by RDP greeter activity to detect anomalous session transitions.

How to Mitigate CVE-2024-5148

Immediate Actions Required

Apply the vendor-supplied gnome-remote-desktop updates referenced in the Red Hat advisory and equivalent advisories for other distributions.
Restrict local interactive and shell access on hosts that expose GNOME Remote Desktop, since exploitation requires a local D-Bus foothold.
Rotate the RDP TLS certificate and key on any host where exposure is suspected, as the prior key material must be treated as compromised.

Patch Information

Red Hat tracks the fix in Bugzilla #2282003, and the upstream remediation is recorded in GNOME Remote Desktop Issue #196. Administrators should install the patched package version provided by their distribution and restart the gnome-remote-desktop service.

Workarounds

Disable the gnome-remote-desktop service (systemctl disable --now gnome-remote-desktop.service) on hosts that do not require RDP access until patches are applied.
Block inbound TCP port 3389 at the host firewall to prevent remote login attempts that would trigger the vulnerable transition path.
Limit which local accounts can reach the system D-Bus by enforcing PolicyKit and D-Bus configuration restrictions on the gnome-remote-desktop interfaces.

bash

# Disable the service and block RDP until patched
sudo systemctl disable --now gnome-remote-desktop.service
sudo firewall-cmd --permanent --remove-port=3389/tcp
sudo firewall-cmd --reload

# After patching, confirm the installed version
rpm -q gnome-remote-desktop