Bug 1677288 (CVE-2018-20781)

Summary:	CVE-2018-20781 gnome-keyring: user's login credentials is kept in a session-child process resulting in exposed plaintext password
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abhgupta, debarshir, dking, gnome-sig, jokerman, mclasen, stefw, sthangav, trankin
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-04-22 04:32:19 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1677289
Bug Blocks:	1677301

Description msiddiqu 2019-02-14 13:25:22 UTC

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

Upstream Issue: 

https://gitlab.gnome.org/GNOME/gnome-keyring/issues/3

Reference:

https://bugzilla.gnome.org/show_bug.cgi?id=781486
https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/1772919

Comment 1 msiddiqu 2019-02-14 13:25:37 UTC

Created libgnome-keyring tracking bugs for this issue:

Affects: fedora-all [bug 1677289]

Comment 2 msiddiqu 2019-02-14 13:26:37 UTC

External References:

https://gitlab.gnome.org/GNOME/gnome-keyring/tags/3.27.2

Comment 3 Doran Moppert 2019-03-05 04:33:14 UTC

To exploit this flaw, an attacker would need to read the memory of a local process under the uid of the target user. While exposing the user's password is significant, having this capacity puts the attacker definitively "within the gates" and already in a position to steal sensitive data if not worse.  Thus downgrading severity to Low.

libgnome-keyring is not affected by this issue.

Comment 6 Product Security DevOps Team 2020-04-22 04:32:19 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-20781