Permissions, Privileges, and Access Controls in gnome-shell - CVE-2023-43090

Vulnerability identifier: #VU81043

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-43090

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to gain access to sensitive information.

The vulnerability exists due to certain key combinations remain active when the user session is locked. An attacker with physical access to device can activate the "single window mode" and "video" buttons in GNOME Screenshot utility by pressing twice the "V" then once the "W" key and record screen or make screenshots.

gnome-shell
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Workstation Extension 15
Desktop Applications Module
openSUSE Leap
Anolis OS
Ubuntu
gnome-shell (Debian package)
gnome-shell
gnome-shell-doc
gnome-shell (Ubuntu package)
gnome-extensions
gnome-shell-debugsource
gnome-shell-calendar-debuginfo
gnome-shell-debuginfo
gnome-shell-devel
gnome-shell-calendar
gnome-shell-lang

Install updates from vendor's website.

gnome-shell - addressed in versions 43.9, 44.5
gnome-shell (Debian package) - update to 43.6-1~deb12u2
gnome-shell - update to 44.1-2
gnome-shell-doc - update to 44.1-2
gnome-shell (Ubuntu package) - update to 44.3-0ubuntu1.1
gnome-extensions - update to 45.3-150600.5.6.1
gnome-shell - update to 45.3-150600.5.6.1
gnome-shell-debugsource - update to 45.3-150600.5.6.1
gnome-shell-calendar-debuginfo - update to 45.3-150600.5.6.1
gnome-shell-debuginfo - update to 45.3-150600.5.6.1
gnome-shell-devel - update to 45.3-150600.5.6.1
gnome-shell-calendar - update to 45.3-150600.5.6.1
gnome-shell-lang - update to 45.3-150600.5.6.1

• https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6990
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1052067
• https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/2944

• Security restrictions bypass in gnome-shell
• Ubuntu update for gnome-shell
• Debian update for gnome-shell
• SUSE update for gnome-shell
• Anolis OS update for gnome-shell