CVE-2024-6655: 
Rocky Linux vulnerability analysis and mitigation

A security vulnerability (CVE-2024-6655) was discovered in the GTK library (GTK-2/GTK-3) that allows for library injection from the current working directory (CWD). The issue was reported on June 14, 2024, and was fixed in GTK-3 version 3.24.43. The vulnerability affects GTK-based applications where under certain conditions, a malicious library can be injected into a GTK application from the current working directory (OSS Security, GTK MR).

The vulnerability exists in the GTK module loading mechanism. When a GTK module is requested but not found in standard paths, the library attempts to load it from the current working directory. This occurs through the findmodule() function, which uses gmoduleopen() to load modules. The issue is particularly concerning when GTK modules are specified through environment variables (GTK2MODULES/GTKMODULES for GTK-2, and GTK3MODULES/GTK_MODULES for GTK-3), command line parameters, or runtime changes in GTK settings. The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (Red Hat CVE).

The vulnerability can lead to arbitrary code execution through library injection. An attacker can craft malicious library files that would be loaded by vulnerable GTK applications when executed from a directory containing these files. This is particularly dangerous in scenarios where users are tricked into downloading malicious content and subsequently running GTK applications from the download directory (OSS Security).

The GTK project has released version 3.24.43 which includes a fix for this vulnerability. GTK-2 will not receive an official fix as it is no longer maintained. Major Linux distributions have released security updates: Ubuntu published fixes for all supported LTS versions on July 16, 2024, and Debian released fixes in versions 12.7 and 11.11 on August 31, 2024. Red Hat has also released fixes through security advisories RHSA-2024:6963 and RHSA-2024:9184 (Red Hat Errata, Red Hat Errata).