Bug 1672825 (CVE-2019-3825)

Summary:	CVE-2019-3825 gdm: lock screen bypass when timed login is enabled
Product:	[Other] Security Response	Reporter:	Doran Moppert <dmoppert>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	caillon+fedoraproject, gnome-sig, hdegoede, john.j5live, mclasen, normand, rhughes, rstrode, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	gdm 3.31.4	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was discovered in gdm when timed login is enabled in configuration. An attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire at which time they would gain access to the logged-in user's session.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-28 16:32:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1672827, 1672829, 1672830
Bug Blocks:	1672816

Description Doran Moppert 2019-02-06 01:05:08 UTC

Under the right circumstances, after the timed login timeout expires, a running session may get misassociated with the timed login user instead of the user that started the session. Further attempts to log in as the timed login user will instead unlock the misassociated user session.

This only affects X.org since, gdm kills the login screen on wayland after login.

Timed logins must be enabled to expose this vulnerability.

Upstream issue:

https://gitlab.gnome.org/GNOME/gdm/issues/460

Comment 1 Doran Moppert 2019-02-06 01:05:10 UTC

Acknowledgments:

Name: the GNOME Project
Upstream: Burghard Britzke

Comment 2 Doran Moppert 2019-02-06 01:05:12 UTC

Mitigation:

Ensure timed login is not enabled in gdm configuration, by checking the output of:

~~~
grep TimedLogin /etc/gdm/custom.conf
~~~

Comment 4 Doran Moppert 2019-02-06 01:09:02 UTC

Created gdm tracking bugs for this issue:

Affects: fedora-all [bug 1672830]

Comment 7 Doran Moppert 2019-02-07 23:44:29 UTC

External References:

https://gitlab.gnome.org/GNOME/gdm/issues/460
https://gitlab.gnome.org/GNOME/gdm/merge_requests/58

Comment 8 errata-xmlrpc 2020-04-28 15:50:50 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:1766 https://access.redhat.com/errata/RHSA-2020:1766

Comment 9 Product Security DevOps Team 2020-04-28 16:32:26 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-3825