CVE-2010-0732: Race Condition
Chris Coulson reported gnome-screensaver is prone to race condition between two subsequent actions -- shaking the unlock dialog and clearing the screen. A local attacker could use this flaw to cause a denial of service (gnome-screensaver crash), which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended.
Upstream bug report: https://bugzilla.gnome.org/showbug.cgi?id=598476
Upstream patch: http://git.gnome.org/browse/gnome-screensaver/commit/?id=ab08cc93f2dc6223c8c00bfa1ca4f2d89069dbe0
CVE Request: http://www.openwall.com/lists/oss-security/2010/02/12/1
References: http://www.heise.de/newsticker/meldung/Gnome-Bildschirmsperre-in-OpenSuse-Linux-wirkungslos-928580.html
Other sources
gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDKWINDOWFOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0732?
CVE-2010-0732 is considered a denial of service vulnerability that can cause gnome-screensaver to crash.
How do I fix CVE-2010-0732?
To fix CVE-2010-0732, update gnome-screensaver and GTK to versions above 2.28.1 and 2.18.5 respectively.
Who is affected by CVE-2010-0732?
CVE-2010-0732 affects users of gnome-screensaver versions prior to 2.28.1 and GTK versions prior to 2.18.5.
Can a local attacker exploit CVE-2010-0732?
Yes, a local attacker can exploit CVE-2010-0732 to crash gnome-screensaver and potentially gain unauthorized access.
What is the nature of the flaw in CVE-2010-0732?
The flaw in CVE-2010-0732 is a race condition between the unlock dialog and screen clearing actions.