Fingerprint login can be changed without authentication

[Alex Jones]

In Ubuntu 18.04, a new fingerprint can be registered without authentication, allowing the bypass of any authentication mechanism that is configured to use the fingerprint reader, for example, sudo. The version number of libfprint on my system is 1:0.7.0-1

[Seth Arnold (seth-arnold)]

Hello Alex, could you please describe the steps necessary to recreate this issue?

Is there any chance you're in a position to test the forthcoming cosmic release?

Thanks

[Alex Jones (blenheimears)]

To enroll a new fingerprint, a malicious user would simply run fprintd-enroll or open the users applet in the Gnome configuration settings, and then enroll their own finger. It does not ask for authentication such as the user's password or an existing fingerprint. The malicious user can then sudo to root if sudo is configured to allow fingerprint authentication. This is not the default but it is very likely that users will enable this.

[Seth Arnold (seth-arnold)]

Hey Marco, this sounds a lot like 1532264 -- any ideas?

Thanks

[Marco Trevisan (Treviño) (3v1n0)]

Yes, This is something that we can prevent with a pk config, but upstream wasn't fine with that as proper solution, but is something we can ship for ubuntu in the mean time.

[Marc Deslauriers (mdeslaur)]

I am going to mark this as a dupe of bug 1532264 since it looks to be the same root cause. Thanks!