PT-2018-5374 · Gnome+1 · Gdm+1

Cedric Buissart + 1 · Published 2017-05-11 · Updated 2024-06-15 · CVE-2017-12164

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions gdm version 3.24.1

Description A flaw was discovered in gdm where the gdm greeter was no longer setting the ran once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen.

Recommendations For gdm version 3.24.1, update to a version where the gdm greeter correctly sets the ran once boolean during autologin to prevent attackers from unlocking screens by selecting 'login as another user'.

Fix

Improper Initialization

Weakness Enumeration

CWE-592

CWE-665

Related Identifiers

ALT-PU-2017-1588

ALT-PU-2017-2192

CVE-2017-12164

MGASA-2018-0056

OPENSUSE-SU-2024:10780-1

Affected Products

Alt Linux

Gdm

References · 20

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-12164 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/gdm/commit/ff98b28 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0056.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10780-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0056 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12164 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/CUDXKEMLQPVFJP52PBLEOLKUMYUY25UJ · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12164 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-12164 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1588 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12164 · Patch
• https://security-tracker.debian.org/tracker/CVE-2017-12164 · Vendor Advisory
• https://suse.com/security/cve/CVE-2018-14424 · Note
• https://suse.com/security/cve/CVE-2019-3825 · Note