Every CVE Search/ Get API key

CVE-2024-38394

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through...

4.3 MediumFix availableDisputed

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.32%Up 0.3 points since Jun 16, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.3

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Record
CVE-2024-38394
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
EUVDEUVD-2024-37298 4.3

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Record
EUVD-2024-37298
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-x65h-q64w-pjcg 4.3

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through...

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Record
GHSA-x65h-q64w-pjcg
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
NVD 4.3

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Record
CVE-2024-38394
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSV 4.3

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Record
CVE-2024-38394
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2024-38394 4.3

Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying device matching logic allow a physically proximate attacker to access some unintended Linux kernel USB functionality, such as USB device-specific kernel modules and filesystem implementations. NOTE: the GSD supplier indicates that consideration of a mitigation for this within GSD would be in the context of "a new feature, not a CVE."

Record
DEBIAN-CVE-2024-38394
CVSS 3.1
4.3 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:14060-1 No score

gnome-settings-daemon-46.0-5.1 on GA media

These are all security issues fixed in the gnome-settings-daemon-46.0-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14060-1
Updated
2026-11-02
OSVSUSE-SU-2024:2168-1 No score

Security update for gnome-settings-daemon

This update for gnome-settings-daemon fixes the following issues:

  • CVE-2024-38394: Fixed mismatches in interpreting USB authorization policy (bsc#1226423).
Record
SUSE-SU-2024:2168-1
Updated
2026-11-02
OSVSUSE-SU-2024:2170-1 No score

Security update for gnome-settings-daemon

This update for gnome-settings-daemon fixes the following issues:

  • CVE-2024-38394: Fixed mismatches in interpreting USB authorization policy (bsc#1226423).
Record
SUSE-SU-2024:2170-1
Updated
2026-11-02
OSVSUSE-SU-2024:2186-1 No score

Security update for gnome-settings-daemon

This update for gnome-settings-daemon fixes the following issues:

  • CVE-2024-38394: Fixed mismatches in interpreting USB authorization policy (bsc#1226423).
Record
SUSE-SU-2024:2186-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
gnome-settings-daemon
Debian:12
 All versions, plus listed versions
43.0-444.0-144.1-144.1-244~beta-1
Show 37 moreShow less
44~rc-145.0-145.0-245.1-145~beta-145~rc-146.0-146.0-246.0-346.0-446.0-546~beta-146~beta-247.1-147.1-247.2-147~beta-147~rc-148.0-148.1-148.1-248~beta-148~rc-149.0-149.1-149.1-249.1-349.1-449.1-550.0-150.0-250.1-151.0-151.0-251~beta-151~beta-251~rc-1
 None known
gnome-settings-daemon
Debian:13
 All versions, plus listed versions
48.1-148.1-249.0-149.1-149.1-2
Show 11 moreShow less
49.1-349.1-449.1-550.0-150.0-250.1-151.0-151.0-251~beta-151~beta-251~rc-1
 None known
gnome-settings-daemon
Debian:14
 All versions, plus listed versions
48.1-148.1-249.0-149.1-149.1-2
Show 11 moreShow less
49.1-349.1-449.1-550.0-150.0-250.1-151.0-151.0-251~beta-151~beta-251~rc-1
 None known
gnome-settings-daemon
SUSE:Linux Enterprise Module for Desktop Applications 15 SP5
 before 41.0-150500.4.3.1
41.0-150500.4.3.1
gnome-settings-daemon
openSUSE:Leap 15.5
 before 41.0-150500.4.3.1
41.0-150500.4.3.1
gnome-settings-daemon
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 41.0-150400.3.3.1
41.0-150400.3.3.1
gnome-settings-daemon
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 41.0-150400.3.3.1
41.0-150400.3.3.1
gnome-settings-daemon
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 41.0-150400.3.3.1
41.0-150400.3.3.1
gnome-settings-daemon
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 41.0-150400.3.3.1
41.0-150400.3.3.1
gnome-settings-daemon
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
 before 45.1-150600.3.3.1
45.1-150600.3.3.1
gnome-settings-daemon
openSUSE:Leap 15.6
 before 45.1-150600.3.3.1
45.1-150600.3.3.1
gnome-settings-daemon
openSUSE:Tumbleweed
 before 46.0-5.1
46.0-5.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38394 is a medium vulnerability (CVSS 4.3) in gnome-settings-daemon, published June 15, 2024. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 24th percentile. Fixed in gnome-settings-daemon 41.0-150500.4.3.1.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open