Gnome Desktop -- After Usermode Application Crashes, Reveals User Passwords by Pressing Ctrl+Alt+F1

[Thomas Carlisle]

>> Intro & Trigger Conditions <<
I have seen this happen more than once, so it isn't a fluke. I am not asking for the IntelliJ/JVM crash to be solved, but am more concerned with the security issues that happen after a userspace app crash.

That said, I am unable to specifically trigger this any way other than using IntelliJ 2018.2 under Oracle JDK 1.8_181 for a significant amount of time. When it abends it may crash to the desktop, or crash Gnome completely. In either case, once that happens you get the unexpected behavior. IntelliJ is not running as root or sudo.

>> What Happens <<
Once the IntelliJ/JVM has crashed, until the system is fully rebooted any time any user logs in or unlocks the terminal, the password they type in the login/unlock UI appears in plaintext one the terminal session you don't usually see. If one pressed Ctrl+Alt+F1 that terminal screen will appear briefly, and on that terminal one can see all the passwords that any user has typed while logging in or unlocking since the crash occurred.

>> System Info <<
Ubuntu 18.04.1 LTS x64 installed clean less than 2 months ago. All hardware drivers are from the Ubuntu distribution and not a third party. IntelliJ and Oracle JDK are not from the Ubuntu repos.

Thank you,
Tom Carlisle
<email address hidden>

[Thomas Carlisle (tcarlisle2012)]

Here is a screen shot. Also, this screen is revealed once again briefly when the system is shut down or rebooted.

[Thomas Carlisle (tcarlisle2012)]

Hello, since posting the bug report here the system where this behavior was seen has since been diagnosed with hardware issues which explain the JVM/IntelliJ crashing. Specifically, running tests in memtest86 reveal failures.

Upon discovering that, I was inclined to say that this reported issue might be moot as it seems impossible to expect a system with this kind of hardware issue to be secure. However, I still wonder if it might be worth checking how passwords could possibly end up on that console. Because if the passwords go there under normal operation, but we rely on the various OS components to ensure that the screen never becomes visible, then that would be a potential avenue for exploiters to attack.

[Seth Arnold (seth-arnold)]

Hello Thomas, thanks for the bug report. I'm pretty sure I've seen an open bug for the passwords-on-vt1 recently, but I'm currently having trouble tracking it down.

Good luck with your hardware issues.

Thanks

[Seth Arnold (seth-arnold)]

Hello Thomas, please see if this addresses your issue:

https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/1767918

Thanks

[Daniel van Vugt (vanvugt)]

Yes, the fix for 18.04 was released 18 hours ago. I think this is a duplicate of bug 1767918.

[Thomas Carlisle (tcarlisle2012)]

Hello Seth & Daniel. I tested after the update and was not able to duplicate the issue. I'd be comfortable closing this out, but don't see an option. FYI -- I removed my screen shot since this was made public, and there is a screen shot to the other ticket if anyone needs to see what it looked like.

[Daniel van Vugt (vanvugt)]

Thomas,

Glad to hear the bug is fixed for you. It is an unfortunate feature of Launchpad that many users can't tell whether a bug is open or closed.

This bug is actually closed already, by being a duplicate. So anyone can keep commenting on it, but it won't show up in searches or bug counts any more. There is nothing more that needs to be done.