CVE-2013-2190: Low severity libclutter-1.0-0 vulnerability
A security flaw was found in the way Clutter, an open source software library for creating rich graphical user interfaces, used to manage translation of hierarchy events in certain circumstances (when underlying device disappeared, causing XIQueryDevice query to throw an error). Physically proximate attackers could use this flaw for example to obtain unauthorized access to gnome-shell session right after system resume (due to gnome-shell crash).
Upstream bug: [1] https://bugzilla.gnome.org/showbug.cgi?id=701974
References: [2] http://www.openwall.com/lists/oss-security/2013/06/18/7 [3] http://www.openwall.com/lists/oss-security/2013/06/19/1
Relevant upstream patch: [4] https://git.gnome.org/browse/clutter/commit/?h=clutter-1.14&id=e310c68d7b38d521e341f4e8a36f54303079d74e (against clutter v1.14) [5] https://git.gnome.org/browse/clutter/commit/?h=clutter-1.16&id=d343cc6289583a7b0d929b82b740499ed588b1ab (against clutter v1.16)
Other sources
The translatehierarchyevent function in x11/clutter-device-manager-xi2.c in Clutter, when resuming the system, does not properly handle XIQueryDevice errors when a device has "disappeared," which causes the gnome-shell to crash and allows physically proximate attackers to access the previous gnome-shell session via unspecified vectors.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2190?
CVE-2013-2190 is rated as a moderate severity vulnerability due to potential impact on system stability and user interface behavior.
How do I fix CVE-2013-2190?
To fix CVE-2013-2190, update Clutter to a version that applies the necessary security patches or consider applying workarounds if available.
What systems are affected by CVE-2013-2190?
CVE-2013-2190 affects Clutter and specifically the openSUSE versions 12.2 and 12.3.
What type of vulnerability is CVE-2013-2190?
CVE-2013-2190 is a security flaw in the Clutter library related to event handling during device disappearance.
Is there any data loss associated with CVE-2013-2190?
CVE-2013-2190 does not directly indicate a risk of data loss, but it may affect user interface responsiveness and system usability.