Under the right circumstances, after the timed login timeout expires, a running session may get misassociated with the timed login user instead of the user that started the session. Further attempts to log in as the timed login user will instead unlock the misassociated user session. This only affects X.org since, gdm kills the login screen on wayland after login. Timed logins must be enabled to expose this vulnerability. Upstream issue: https://gitlab.gnome.org/GNOME/gdm/issues/460
Acknowledgments: Name: the GNOME Project Upstream: Burghard Britzke
Mitigation: Ensure timed login is not enabled in gdm configuration, by checking the output of: ~~~ grep TimedLogin /etc/gdm/custom.conf ~~~
Created gdm tracking bugs for this issue: Affects: fedora-all [bug 1672830]
External References: https://gitlab.gnome.org/GNOME/gdm/issues/460 https://gitlab.gnome.org/GNOME/gdm/merge_requests/58
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:1766 https://access.redhat.com/errata/RHSA-2020:1766
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-3825