17.04: GDM lock screen can be circumvented when autologin is set

Bug #1729354 reported by Jeremy Bícha
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Fix Released
gdm3 (Ubuntu)
Fix Released

Bug Description

Test Case
Steps to Reproduce:
1. From Ubuntu GNOME 17.04, open the Settings app.
2. Click User Accounts then Unlock then turn on Automatic Login for your account
3. Reboot
4. Lock screen (there is a lock button in the system status menu in the right of the top bar)
5. Click the log in as another user button below the password prompt.

Actual results:
The screen unlocks without a password being entered.

Expected results:
A selection of other accounts is shown.

Testing Done
I confirmed that the test case succeeds with a locally built package using the provided debdiff.

Other Info
Cherry-picking this commit:

Introduced in

Therefore, this should only affect Ubuntu 17.04. Ubuntu GNOME was the only Ubuntu flavor to ship GDM by default in 17.04.


Tags: zesty

CVE References

Revision history for this message
Jeremy Bícha (jbicha) wrote :

debdiff attached

Changed in gdm3 (Ubuntu):
status: New → Confirmed
description: updated
Jeremy Bícha (jbicha)
tags: added: zesty
removed: artul
description: updated
Changed in gdm3 (Ubuntu):
importance: Undecided → High
status: Confirmed → Triaged
Changed in gdm:
importance: Unknown → Medium
status: Unknown → Fix Released
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

ACK on the debdiff in comment #1, package is building now. Thanks!

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gdm3 - 3.24.1-0ubuntu0.2

gdm3 (3.24.1-0ubuntu0.2) zesty-security; urgency=medium

  * SECURITY UPDATE: lock screen bypass when autologin enabled
    - debian/patches/CVE-2017-12164.patch: daemon/gdm-manager.c:
      only allow autologin from initial display (LP: #1729354)
    - CVE-2017-12164

 -- Jeremy Bicha <email address hidden> Wed, 01 Nov 2017 11:16:26 -0400

Changed in gdm3 (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.