A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen.
CVSS Details
- CVSS 3.1 Base Score: 4.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade gdm3 | Jul 30, 2024 | Jul 26, 2018 |
| Suse | — | Upgrade gdm-systemdUpgrade gdm-develUpgrade gdmflexiserverUpgrade gdmUpgrade typelib-1_0-Gdm-1_0Upgrade libgdm1Upgrade gdm-lang | May 20, 2018 | May 20, 2018 |
| Ubuntu | — | Upgrade gdm3 | Nov 19, 2024 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub