In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript codes behavior.
Weakness
The product does not properly verify that the source of data or communication is valid.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | RedHat | gnome-shell-0:3.32.2-56.el8_10 | * |
| Red Hat Enterprise Linux 9 | RedHat | gnome-shell-0:40.10-21.el9 | * |
| Red Hat Enterprise Linux 9.4 Extended Update Support | RedHat | gnome-shell-0:40.10-19.el9_4 | * |
| Gnome-shell | Ubuntu | devel | * |
| Gnome-shell | Ubuntu | esm-infra/focal | * |
| Gnome-shell | Ubuntu | focal | * |
| Gnome-shell | Ubuntu | jammy | * |
| Gnome-shell | Ubuntu | mantic | * |
| Gnome-shell | Ubuntu | noble | * |
| Gnome-shell | Ubuntu | upstream | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/111.html
- https://cwe.mitre.org/data/definitions/141.html
- https://cwe.mitre.org/data/definitions/142.html
- https://cwe.mitre.org/data/definitions/160.html
- https://cwe.mitre.org/data/definitions/21.html
- https://cwe.mitre.org/data/definitions/384.html
- https://cwe.mitre.org/data/definitions/385.html
- https://cwe.mitre.org/data/definitions/386.html
- https://cwe.mitre.org/data/definitions/387.html
- https://cwe.mitre.org/data/definitions/388.html
- https://cwe.mitre.org/data/definitions/510.html
- https://cwe.mitre.org/data/definitions/59.html
- https://cwe.mitre.org/data/definitions/60.html
- https://cwe.mitre.org/data/definitions/75.html
- https://cwe.mitre.org/data/definitions/76.html
- https://cwe.mitre.org/data/definitions/89.html