CVE-2014-5195: Race Condition
Published Aug 7, 2014
·Updated
Unity before 7.2.3 and 7.3.x before 7.3.1, as used in Ubuntu, does not properly take focus of the keyboard when switching to the lock screen, which allows physically proximate attackers to bypass the lock screen by (1) leveraging a machine that had text selected when locking or (2) resuming from a suspension.
Affected Software
5 affected components
Ayatana Project Unity<=7.2.2
Ayatana Project Unity=7.2.0
Ayatana Project Unity=7.2.1
Ayatana Project Unity=7.3.0
Ubuntu=14.04
Event History
Aug 7, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
Who is exposed to this issue?
Systems using affected Unity versions are exposed when an attacker can physically access the machine. The issue is specifically described for Unity as used in Ubuntu.
2
What conditions allow the lock screen to be bypassed?
The bypass can occur if text was selected when the machine was locked, or when the system resumes from suspension. Exploitation requires physical proximity rather than remote network access.
3
Which versions are affected?
Unity versions before 7.2.3 and Unity 7.3.x versions before 7.3.1 are affected.