CVE-2017-8288: Input Validation
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8288?
CVE-2017-8288 has a medium severity, as it allows unauthorized access to application information through enabled extensions on the lock screen.
How do I fix CVE-2017-8288?
To mitigate CVE-2017-8288, upgrade to gnome-shell version 3.38.6-1~deb11u2 or higher.
Which versions of gnome-shell are affected by CVE-2017-8288?
CVE-2017-8288 affects gnome-shell versions 3.22.0 to 3.24.1.
What are the implications of CVE-2017-8288 for users?
Users may inadvertently expose application information to unauthorized individuals due to extensions remaining enabled in the lock screen.
Is CVE-2017-8288 a server-side vulnerability?
CVE-2017-8288 is primarily a client-side vulnerability affecting the gnome-shell user interface.