Permissions, Privileges, and Access Controls in gdm3 (Ubuntu package) - CVE-2020-16125

Vulnerability identifier: #VU48381

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-16125

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to unresponsive accounts-daemon, which leads to security restrictions bypass and privilege escalation.

gdm3 (Ubuntu package)
gdm
gdm-devel
gdm-debugsource
gdm-debuginfo
Arch Linux
Ubuntu
openEuler

Install updates from vendor's website.

gdm3 (Ubuntu package) - addressed in versions 3.36.3-0ubuntu0.20.04.1, 3.28.3-0ubuntu18.04.6, 3.36.3-0ubuntu0.20.04.2, 3.38.1-2ubuntu1.1
gdm - update to 3.30.1-8
gdm-devel - update to 3.30.1-8
gdm-debugsource - update to 3.30.1-8
gdm-debuginfo - update to 3.30.1-8

• Exploit #9225 - CVE-2020-16125-Reproduction () (August 3, 2023)

• https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/1900314
• https://gitlab.gnome.org/GNOME/gdm/-/issues/642
• https://securitylab.github.com/advisories/GHSL-2020-202-gdm3-LPE-unresponsive-accounts-daemon

• Privilege escalation in gdm3 (Ubuntu package)
• Arch Linux update for gdm
• openEuler 20.03 LTS update for gdm
• Ubuntu update for gdm3