CVE-2024-34397

What it actually does

GDBus clients in GLib accept spoofed D-Bus signals from unprivileged local users as if they originated from trusted system services such as NetworkManager because signal subscriptions do not enforce sender authentication on shared systems.

Why it matters to the business

Applications built on GLib D-Bus may perform incorrect actions on multi-user computers, leading to configuration changes, service disruptions, or other application-specific misbehavior without remote access required.

How an attack unfolds

A local user on a shared machine identifies GDBus-based clients listening for signals from trusted services, then injects crafted D-Bus messages that the client accepts as authentic, causing the client to react as though the trusted service sent the signal.

How to fix it

Upgrade GLib to version 2.78.5 or 2.80.1; apply commit d18807b5ffc6dedc2db5225b044063f65720bf56 in GIT builds; rebuild and redeploy any dependent applications after the library update.

How to confirm the fix worked

Confirm installed GLib version is at or above the fixed releases; review D-Bus signal handling code in dependent applications for proper sender verification; test that spoofed signals are rejected after upgrade.

Typical attack path

1. Obtain local user account on a multi-user system running affected GLib
2. Locate GDBus clients that subscribe to signals from services such as NetworkManager
3. Craft and emit spoofed D-Bus signals impersonating the trusted service
4. Trigger application-dependent incorrect behavior in the targeted client

How to detect it

Monitor D-Bus system logs for signals originating from unexpected local users or processes; review application logs for anomalous reactions to NetworkManager or similar service signals on shared hosts.

What your security team should do

• Immediately update GLib packages on all multi-user systems to the fixed versions
• Audit applications using GDBus signal subscriptions for reliance on unauthenticated messages
• Restrict multi-user access on systems where high-impact GLib clients run until patched