CVE-2020-27837: Race Condition
First published: Fri Dec 11 2020(Updated: )
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/gdm | <3.38.2.1 | 3.38.2.1 |
| Gnome Gnome Display Manager | <3.38.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2017-12164
- https://gitlab.gnome.org/GNOME/gdm/-/issues/660
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1908276
- https://gitlab.gnome.org/GNOME/gdm/-/commit/dcdbaaa04012541ad2813cf83559d91d52f208b9
- https://access.redhat.com/security/cve/cve-2020-27837
- https://bugzilla.redhat.com/show_bug.cgi?id=1906812
Frequently Asked Questions
What is CVE-2020-27837?
CVE-2020-27837 is a vulnerability found in GDM versions prior to 3.38.2.1.
What is the severity of CVE-2020-27837?
The severity of CVE-2020-27837 is medium with a CVSS score of 6.4.
How can CVE-2020-27837 be exploited?
CVE-2020-27837 can be exploited by bypassing the lock screen for a user with autologin enabled, allowing unauthorized access to their session.
What is the remediation for CVE-2020-27837?
To fix CVE-2020-27837, update GDM to version 3.38.2.1 or later.
Is there any additional information available for CVE-2020-27837?
Yes, you can find more information about CVE-2020-27837 at the following references: [Reference 1](https://access.redhat.com/security/cve/CVE-2017-12164), [Reference 2](https://gitlab.gnome.org/GNOME/gdm/-/issues/660), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1908276).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- agent/last-modified-date
- agent/tags
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-27837
- agent/software-canonical-lookup
- vendor/gnome
- canonical/gnome gnome display manager
- package-manager/redhat