Vulnerability identifier: #VU17709

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3820

CWE-ID: CWE-264

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
gnome-shell
Client/Desktop applications / Software for system administration

Vendor: Gnome Development Team

Description

The vulnerability allows a physical attacker to bypass security restrictions on the system.

The vulnerability exists due to the lock screen feature does not properly restrict all contextual actions. A physical attacker can click on the password text field to bypass the lock screen and re-enable certain keyboard shortcuts, which the attacker can use to perform unauthorized actions on the system.

Mitigation
Update to version 3.31.90.

Vulnerable software versions

gnome-shell: 3.31.0 - 3.31.4, 3.30.0 - 3.30.2, 3.29.0 - 3.29.92, 3.28.0 - 3.28.3, 3.27.0 - 3.27.92, 3.26.1 - 3.26.2, 3.25.0 - 3.25.91) | 3.26.0, 3.24.0 - 3.24.3, 3.23.0 - 3.23.92, 3.22.0 - 3.22.3, 3.21.0 - 3.21.92, 3.20.0 - 3.20.4, 3.19.0 - 3.19.92, 3.18.0 - 3.18.5, 3.17.0 - 3.17.92, 3.16.0 - 3.16.2, 3.15.91 - 3.15.92

---

External links
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3820
http://gitlab.gnome.org/GNOME/gnome-shell/issues/851

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.