Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-12164 |
CWE-ID | CWE-665 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
GNOME Display Manager Client/Desktop applications / Other client software |
Vendor | Gnome Development Team |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU36816
Risk: Medium
CVSSv3.1: 5.6 [CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-12164
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a local non-authenticated attacker to execute arbitrary code.
A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen.
MitigationInstall update from vendor's website.
Vulnerable software versionsGNOME Display Manager: 3.24.1
External linkshttp://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12164
http://gitlab.gnome.org/GNOME/gdm/commit/ff98b28
Q & A
Can this vulnerability be exploited remotely?
No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.