CVE-2024-36041

What it actually does

KSmserver accepts all local ICE connections without authentication, allowing any local user to connect to the session manager and abuse session-restore functionality to inject code that executes as another user on subsequent login via /tmp artifacts.

Why it matters to the business

On multi-user systems running affected KDE Plasma versions, a malicious local account can achieve arbitrary code execution under another user's context on the next boot, increasing risk of lateral movement or persistence in shared environments.

How an attack unfolds

An attacker with a local account on the same host connects to KSmserver via unauthenticated ICE, manipulates the session manager state, plants malicious session-restore data in /tmp, and waits for the victim to log in again so the code runs with the victim's privileges.

How to fix it

Upgrade plasma-workspace to version 5.27.11.1 or later for the 5.27 series, and to 6.0.5.1 or later for the 6.x series. Restrict multi-user access on shared systems until patches are applied and consider disabling session restore if immediate upgrade is not feasible.

How to confirm the fix worked

Verify the installed plasma-workspace package version is at least 5.27.11.1 or 6.0.5.1, confirm ICE connection handling now requires additional authentication tokens, and test that session-restore no longer processes files from other users' /tmp entries.

Typical attack path

1. Obtain a local shell as a non-privileged user on the target host
2. Connect to KSmserver using the host-only ICE authentication path
3. Modify or inject session-restore entries via the session manager interface
4. Place executable payloads in /tmp that will be loaded on the victim's next login
5. Trigger a logout/login cycle for the victim user to achieve code execution

How to detect it

Review system and session manager logs for unexpected ICE connections from non-owner UIDs, inspect /tmp for session-restore artifacts with suspicious ownership or content, and correlate login events with subsequent process spawns from other users' contexts.

What your security team should do

• Prioritize patching plasma-workspace on all multi-user or shared workstations within the next patch cycle
• Audit systems for concurrent local user logins and limit unnecessary multi-user access
• Monitor for upcoming updates and test in staging before broad deployment
• Document the upgrade versions and re-validate session manager behavior post-install