Security restrictions bypass in GNOME Display Manager - CVE-2019-3825

Vulnerability identifier: #VU17666

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-3825

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a physical attacker to bypass security restrictions on the system.

The vulnerability exists due to improper security restrictions imposed by the affected software when timed login is enabled. A local attacker with physical access can select the timed login user and wait for the timer to expire that allows to bypass security restrictions and gain access to the logged-in user’s session on the targeted system.

GNOME Display Manager
Arch Linux
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Opensuse
openEuler
Fedora
gnome-remote-desktop (Red Hat package)
accountsservice (Red Hat package)
libvncserver (Red Hat package)
gjs (Red Hat package)
gtk3 (Red Hat package)
gnome-tweaks (Red Hat package)
nautilus (Red Hat package)
gnome-control-center (Red Hat package)
gdm (Red Hat package)
evince (Red Hat package)
gnome-boxes (Red Hat package)
gnome-software (Red Hat package)
gsettings-desktop-schemas (Red Hat package)
gnome-settings-daemon (Red Hat package)
gnome-shell (Red Hat package)
mutter (Red Hat package)
appstream-data (Red Hat package)
mozjs60 (Red Hat package)
LibRaw (Red Hat package)
vala (Red Hat package)
libxslt (Red Hat package)
clutter (Red Hat package)
gnome-menus (Red Hat package)
vinagre (Red Hat package)
gnome-session (Red Hat package)
gnome-online-accounts (Red Hat package)
gnome-terminal (Red Hat package)
gdm-debugsource
gdm-debuginfo
gdm
gdm-devel
mozjs52 (Red Hat package)

Update to version 3.31.4.

GNOME Display Manager - update to 3.31.4
gnome-remote-desktop (Red Hat package) - update to 0.1.6-8.el8
accountsservice (Red Hat package) - update to 0.6.50-8.el8
libvncserver (Red Hat package) - update to 0.9.11-14.el8
gjs (Red Hat package) - update to 1.56.2-4.el8
gtk3 (Red Hat package) - update to 3.22.30-5.el8
gnome-tweaks (Red Hat package) - update to 3.28.1-7.el8
nautilus (Red Hat package) - update to 3.28.1-12.el8
gnome-control-center (Red Hat package) - update to 3.28.2-19.el8
gdm (Red Hat package) - update to 3.28.3-29.el8
evince (Red Hat package) - update to 3.28.4-4.el8
gnome-boxes (Red Hat package) - update to 3.28.5-8.el8
gnome-software (Red Hat package) - update to 3.30.6-3.el8
gsettings-desktop-schemas (Red Hat package) - update to 3.32.0-4.el8
gnome-settings-daemon (Red Hat package) - update to 3.32.0-9.el8
gnome-shell (Red Hat package) - update to 3.32.2-14.el8
mutter (Red Hat package) - update to 3.32.2-34.el8
appstream-data (Red Hat package) - update to 8-20191129.el8
mozjs60 (Red Hat package) - update to 60.9.0-4.el8
LibRaw (Red Hat package) - update to 0.19.5-1.el8
vala (Red Hat package) - update to 0.40.19-1.el8
libxslt (Red Hat package) - update to 1.1.32-4.el8
clutter (Red Hat package) - update to 1.26.2-8.el8
gnome-menus (Red Hat package) - update to 3.13.3-11.el8
vinagre (Red Hat package) - update to 3.22.0-21.el8
gnome-session (Red Hat package) - update to 3.28.1-8.el8
gnome-online-accounts (Red Hat package) - update to 3.28.2-1.el8
gnome-terminal (Red Hat package) - update to 3.28.3-1.el8
gdm-debugsource - update to 3.30.1-10
gdm-debuginfo - update to 3.30.1-10
gdm - update to 3.30.1-10
gdm-devel - update to 3.30.1-10
gdm - update to 3.30.3-1.fc29
mozjs52 (Red Hat package) - update to 52.9.0-2.el8

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3825

• Security restrictions bypass in GNOME Display Manager
• OpenSUSE Linux update for gdm
• Arch Linux update for gdm
• Arch Linux update for gdm
• Red Hat Enterprise Linux 8 update for GNOME
• openEuler update for gdm
• Fedora 29 update for gdm