pool/gdm
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 673638 from home:zhangxiaofei:branches:GNOME:Factory

Browse Source 
- Add gdm-CVE-2019-3825.patch: Fix lock screen bypass when timed
  login is enabled (boo#1124628, glgo#GNOME/gdm#460, CVE-2019-3825)

OBS-URL: https://build.opensuse.org/request/show/673638
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/gdm?expand=0&rev=419
This commit is contained in:
Dominique Leuenberger 2019-02-12 12:16:40 +00:00 committed by Git OBS Bridge
parent 0cb3aa30d9
commit 2f2c643041
3 changed files with 59 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
gdm-CVE-2019-3825.patch Normal file
View File

@ -0,0 +1,47 @@
From 92c2a577063f538ce0e44b5cabeb348dab957edf Mon Sep 17 00:00:00 2001
From: Iain Lane <iainl@gnome.org>
Date: Mon, 4 Feb 2019 15:12:38 +0000
Subject: [PATCH] GdmManager: Don't perform timed login if session gets started
At the moment it's possible for the login screen to initiate
a timed login operation shortly after a user successfully starts
their session.
GDM won't complete the timed login operation, since a session is
already running, but will erroneously overwrite the username
associated with the session, misattributing the users session
to the timed login user.
Later, attempts to log in as the timed user will instead unlock the
session for the other user, since that session is now associated
with the timed login user.
This commit refuses timed login requests on sessions that are
already running, so the username doesn't get corrupted.
CVE-2019-3825
Closes https://gitlab.gnome.org/GNOME/gdm/issues/460
---
daemon/gdm-manager.c | 8 ++++++++
1 file changed, 8 insertions(+)
Index: b/daemon/gdm-manager.c
===================================================================
--- a/daemon/gdm-manager.c 2019-02-12 18:40:48.937263065 +0800
+++ b/daemon/gdm-manager.c 2019-02-12 18:41:11.869403958 +0800
@@ -2051,6 +2051,14 @@ on_session_client_connected (GdmSession
g_debug ("GdmManager: client connected");
+ if (gdm_session_is_running (session)) {
+ const char *session_username;
+ session_username = gdm_session_get_username (session);
+ g_debug ("GdmManager: ignoring connection, since session already running (for user %s)",
+ session_username);
+ return;
+ }
+
display = get_display_for_user_session (session);
if (display == NULL) {

12
gdm.changes
View File

@ -1,11 +1,17 @@
-------------------------------------------------------------------
Tue Feb 12 10:49:15 UTC 2019 - Felix Zhang <fezhang@suse.com>
- Add gdm-CVE-2019-3825.patch: Fix lock screen bypass when timed
login is enabled (boo#1124628, glgo#GNOME/gdm#460, CVE-2019-3825)
-------------------------------------------------------------------
Fri Dec 21 02:48:21 UTC 2018 - qzheng@suse.com
- Add gdm-ignore-duplicate-desktop-file.patch to ignore duplicate
desktop file with same "Name" value, including symlinks of
desktop file with same "Name" value, including symlinks of
desktop files (bsc#1112834, glgo#GNOME/gdm#437).
- Drop gdm-ignore-duplicate-session.patch, the patch hardcodes
"default.desktop" while LightDM and SDDM treat symlinks as
- Drop gdm-ignore-duplicate-session.patch, the patch hardcodes
"default.desktop" while LightDM and SDDM treat symlinks as
aliases.
-------------------------------------------------------------------

3
gdm.spec
View File

@ -57,6 +57,8 @@ Patch7: gdm-fails-to-restart-gnome-shell.patch
Patch8: gdm-add-runtime-option-to-disable-starting-X-server-as-u.patch
# PATCH-FIX-UPSTREAM gdm-ignore-duplicate-desktop-file.patch bsc#1112834 glgo#GNOME/gdm#437 qzheng@suse.com -- Ignore duplicate desktop file with same "Name".
Patch9: gdm-ignore-duplicate-desktop-file.patch
# PATCH-FIX-UPSTREAM gdm-CVE-2019-3825.patch boo#1124628 glgo#GNOME/gdm#460 fezhang@suse.com -- Fix lock screen bypass when timed login is enabled
Patch10: gdm-CVE-2019-3825.patch
### NOTE: Keep please SLE-only patches at bottom (starting on 1000).
# PATCH-FIX-SLE gdm-disable-gnome-initial-setup.patch bnc#1067976 qzhao@suse.com -- Disable gnome-initial-setup runs before gdm, g-i-s will only serve for CJK people to choose the input-method after login.
@ -200,6 +202,7 @@ cp %{SOURCE8} .
%patch7 -p1
#patch8 -p1
%patch9 -p1
%patch10 -p1
# TODO: Hack still needed until https://gitlab.gnome.org/GNOME/gdm/issues/424 gets fixed and released.
rm data/61-gdm.rules