Fedora 26 update for gdm

1) Improper Initialization

EUVDB-ID: #VU36816

Risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2017-12164

CWE-ID: CWE-665 - Improper Initialization

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 26

gdm: before 3.24.3-1.fc26

CPE2.3

• cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*
• cpe:2.3:a:fedoraproject:gdm:*:*:*:*:*:fedora:*:*

External links

https://bodhi.fedoraproject.org/updates/FEDORA-2017-e7ae1ed967

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.