CVE-2024-36472

What it actually does

The vulnerability permits automatic launch of a portal helper process triggered by crafted network responses without user interaction, after which the process executes untrusted JavaScript supplied by the adversary, enabling resource exhaustion or further impacts based on the script contents.

Why it matters to the business

Attackers on the same local network can cause denial-of-service conditions or other unpredictable effects on affected systems without any user action, potentially disrupting operations for users on shared or public Wi-Fi.

How an attack unfolds

An adversary controlling the local network fabric (for example a malicious Wi-Fi access point) crafts responses that cause GNOME Shell to automatically invoke a portal helper; the helper then fetches and executes attacker-supplied JavaScript, which may consume excessive resources or perform other actions depending on its payload.

How to fix it

Upgrade GNOME Shell to a version newer than 45.7 that contains the fix for improper input validation of network-triggered portal helper launches; apply all vendor-supplied updates and restart the session or system after installation.

How to confirm the fix worked

Confirm the installed GNOME Shell version is greater than 45.7, review release notes for the specific security fix, and test that network-triggered portal helpers no longer execute without explicit user confirmation.

Typical attack path

1. Position on the same local network as the target (e.g., rogue Wi-Fi AP)
2. Send network responses designed to trigger automatic portal helper launch
3. Supply untrusted JavaScript that the helper loads and executes
4. Observe or amplify resulting resource consumption or other effects

How to detect it

Review system logs for unexpected portal helper process starts correlated with network events, inspect for JavaScript execution artifacts originating from network responses, and correlate with high resource usage on affected hosts.

What your security team should do

• Prioritize patching all systems running GNOME Shell 45.7 or earlier
• Monitor vendor advisories for the exact fixed release and schedule updates
• Restrict automatic network-based portal features where policy permits until patched