CVE-2017-12164 A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as anot...
MediumCVSS 6.4
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/gdm3(Debian:12) | < 3.26.0-1 | 3.26.0-1 |
| debian/gdm3(Debian:13) | < 3.26.0-1 | 3.26.0-1 |
| debian/gdm3(Debian:14) | < 3.26.0-1 | 3.26.0-1 |
| gnome display manager | = 3.24.1 | No fix listed |
| GNOME gdm | = 3.24.1 | No fix listed |
References
- Debian Security Tracker CVE-2017-12164 vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- gitlab.gnome.org patch vendor-advisory