Bug 1225774 (CVE-2024-36041)

Summary: VUL-0: CVE-2024-36041: plasma5-workspace,plasma6-workspace: ksmserver: Unauthorized users can access session manager
Product: [openSUSE] openSUSE Tumbleweed Reporter: Fabian Vogt <fabian>
Component: SecurityAssignee: Security Team bot <security-team>
Status: IN_PROGRESS --- QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P3 - Medium CC: fabian, opensuse-kde-bugs, rfrohl, security-team
Version: Current   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/408355/
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Fabian Vogt 2024-05-31 19:00:05 UTC
CVE-2024-36041 https://kde.org/info/security/advisory-20240531-1.txt

Needs two patches added to plasma5-workspace in 15.5 + 15.6 as well as plasma6-workspace in Tumbleweed.
Comment 1 Fabian Vogt 2024-05-31 19:35:12 UTC
Submissions:

TW: https://build.opensuse.org/request/show/1177981
15.5: https://build.opensuse.org/request/show/1177980 wants a review from backports for some reason?
15.6: https://build.opensuse.org/request/show/1177979 apparently the :Update project isn't set up yet?
Comment 3 OBSbugzilla Bot 2024-06-03 08:45:01 UTC
This is an autogenerated message for OBS integration:
This bug (1225774) was mentioned in
https://build.opensuse.org/request/show/1178248 Backports:SLE-15-SP6 / plasma5-workspace
Comment 4 Marcus Meissner 2024-06-06 13:04:50 UTC
openSUSE-SU-2024:0152-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1225774
CVE References: CVE-2024-36041
JIRA References: 
Sources used:
openSUSE Backports SLE-15-SP5 (src):    plasma5-workspace-5.27.9-bp155.2.6.1
Comment 5 Andreas Schwab 2024-06-07 16:40:18 UTC
This completely breaks session management.  It is no longer possible to restore a session at login, neither the current session nor a manually saved one.
Comment 6 Fabian Vogt 2024-06-08 11:19:58 UTC
(In reply to Andreas Schwab from comment #5)
> This completely breaks session management.  It is no longer possible to
> restore a session at login, neither the current session nor a manually saved
> one.

More details are needed there. I suspect it's because the $ICEAUTHORITY variable is not set properly or the authority file is inaccessible.

Please file a new bug report though, this is only about the security issue.
Comment 7 OBSbugzilla Bot 2024-06-10 14:55:01 UTC
This is an autogenerated message for OBS integration:
This bug (1225774) was mentioned in
https://build.opensuse.org/request/show/1179708 Backports:SLE-15-SP6 / plasma5-workspace