Bug 2550352 (CVE-2026-109832)
| Summary: | CVE-2026-109832 gnome-remote-desktop: Busy-Wait DoS in VNC TLS I/O Handlers (GNUTLS_E_AGAIN / GNUTLS_E_INTERRUPTED) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
AI_ONLY_REPORT package: gnome-remote-desktop-49.3-1.el10 ------ Summary: Busy-Wait DoS in VNC TLS I/O Handlers (`GNUTLS_E_AGAIN` / `GNUTLS_E_INTERRUPTED`): retryable TLS read or write results can trap the VNC event-loop thread in an infinite busy loop, causing sustained CPU exhaustion and loss of VNC service availability. Requirements to exploit: An attacker needs network reachability to a running VNC listener provided by `gnome-remote-desktop`. The issue is configuration-dependent because VNC must be enabled and the connection must exercise the TLS VNC path; the shipped VNC schema uses `tls-anon` as the default allowed encryption method. Component affected: `gnome-remote-desktop`, VNC TLS handlers in `src/grd-vnc-tls.c` (`do_read()` and `grd_vnc_tls_write_to_socket()`), reached from the VNC socket dispatch path in `src/grd-session-vnc.c`. Version affected: RHEL/CentOS gnome-remote-desktop package versions >= 0.1.6-1 through <= 40.0-11 when the VNC service is enabled and the TLS handler path is used (downstream-only). ... Acknowledgement: Aisle Research