Dominique Leuenberger
2f2c643041
- Add gdm-CVE-2019-3825.patch: Fix lock screen bypass when timed login is enabled (boo#1124628, glgo#GNOME/gdm#460, CVE-2019-3825) OBS-URL: https://build.opensuse.org/request/show/673638 OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/gdm?expand=0&rev=419
48 lines
1.7 KiB
Diff
48 lines
1.7 KiB
Diff
From 92c2a577063f538ce0e44b5cabeb348dab957edf Mon Sep 17 00:00:00 2001
|
|
From: Iain Lane <iainl@gnome.org>
|
|
Date: Mon, 4 Feb 2019 15:12:38 +0000
|
|
Subject: [PATCH] GdmManager: Don't perform timed login if session gets started
|
|
|
|
At the moment it's possible for the login screen to initiate
|
|
a timed login operation shortly after a user successfully starts
|
|
their session.
|
|
|
|
GDM won't complete the timed login operation, since a session is
|
|
already running, but will erroneously overwrite the username
|
|
associated with the session, misattributing the users session
|
|
to the timed login user.
|
|
|
|
Later, attempts to log in as the timed user will instead unlock the
|
|
session for the other user, since that session is now associated
|
|
with the timed login user.
|
|
|
|
This commit refuses timed login requests on sessions that are
|
|
already running, so the username doesn't get corrupted.
|
|
|
|
CVE-2019-3825
|
|
|
|
Closes https://gitlab.gnome.org/GNOME/gdm/issues/460
|
|
---
|
|
daemon/gdm-manager.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
Index: b/daemon/gdm-manager.c
|
|
===================================================================
|
|
--- a/daemon/gdm-manager.c 2019-02-12 18:40:48.937263065 +0800
|
|
+++ b/daemon/gdm-manager.c 2019-02-12 18:41:11.869403958 +0800
|
|
@@ -2051,6 +2051,14 @@ on_session_client_connected (GdmSession
|
|
|
|
g_debug ("GdmManager: client connected");
|
|
|
|
+ if (gdm_session_is_running (session)) {
|
|
+ const char *session_username;
|
|
+ session_username = gdm_session_get_username (session);
|
|
+ g_debug ("GdmManager: ignoring connection, since session already running (for user %s)",
|
|
+ session_username);
|
|
+ return;
|
|
+ }
|
|
+
|
|
display = get_display_for_user_session (session);
|
|
|
|
if (display == NULL) {
|