CVE-2020-28049: Race Condition
An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server display contents and, for example, intercept keystrokes or access the clipboard. This is caused by a race condition during Xauthority file creation.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-28049?
CVE-2020-28049 is a vulnerability discovered in SDDM before version 0.19.0 that incorrectly starts the X server in a way that allows local unprivileged users to access X server display contents without proper authentication.
What is the severity of CVE-2020-28049?
CVE-2020-28049 has a severity value of 6.3, which is considered medium.
How does CVE-2020-28049 affect SDDM?
CVE-2020-28049 affects SDDM versions before 0.19.0 by allowing local unprivileged users to create a connection to the X server without proper authentication.
How can I fix CVE-2020-28049?
To fix CVE-2020-28049, it is recommended to update SDDM to version 0.19.0 or higher.
Where can I find more information about CVE-2020-28049?
More information about CVE-2020-28049 can be found in the references provided: [1] [2] [3].