CVE-2010-0422: Medium severity Gnome screensaver vulnerability
gnome-screensaver 2.28.x before 2.28.3 does not properly synchronize the state of screen locking and the unlock dialog in situations involving a change to the number of monitors, which allows physically proximate attackers to bypass screen locking and access an unattended workstation by connecting and disconnecting monitors multiple times, a related issue to CVE-2010-0414.
Other sources
gnome-screensaver can lose its keyboard grab when locked, exposing the system to intrusion by adding and removing monitors.
This issue is similar to but different than bug 609337 (CVE-2010-0414)
Steps to reproduce:
1) Lock screen 2) Plug in new monitor and wait for unlock dialog to show on it. 3) Unplug new monitor, watch unlock dialog move to primary monitor 4) Replug new monitor, watch unlock dialog stay on primary monitor 5) Unplug new monitor 6) hit alt-f2 and type "pkill -f gnome-screensaver"
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0422?
CVE-2010-0422 is classified as a medium severity vulnerability due to its potential for bypassing screen locking.
How do I fix CVE-2010-0422?
To fix CVE-2010-0422, update gnome-screensaver to version 2.28.3 or later.
What versions of gnome-screensaver are affected by CVE-2010-0422?
CVE-2010-0422 affects gnome-screensaver versions 2.28.0, 2.28.1, and 2.28.2.
What type of attack does CVE-2010-0422 enable?
CVE-2010-0422 allows physically proximate attackers to bypass screen locking and access an unattended workstation.
Is CVE-2010-0422 related to monitor configurations?
Yes, CVE-2010-0422 involves improper synchronization of screen locking state when there is a change in the number of monitors.