Major security issue with light-locker - console switching gives access to other screens for a few seconds

[Nathan Neulinger]

light-locker is completely insecure for X configurations with multiple screens that are not using a single display.

My setup - 4 monitors, nvidia, each with separate screen.

If I lock screen and then control-alt-f7 back to X, only one single screen is protected. After several seconds, it forces a switch to the lock display, but in the mean time, the other three screens are COMPLETELY UNPROTECTED.

It only takes a few seconds to launch a terminal and killall light-locker and I have unrestricted access to all.

[Tyler Hicks (tyhicks)]

HI Nathan - Thanks for the bug report. I'm going to make it public so that more people can be aware of this issue in hopes that it'll get attention.

[Tyler Hicks (tyhicks)]

Marking the lightdm as invalid as it seems, from Nathan's description, that the issue is with light-locker.

[Tyler Hicks (tyhicks)]

I've subscribed the light-locker devs team so that they're aware.

Note that bug 1473904 and bug 1440499 are similar light-locker bypass issues.

[Nathan Neulinger (nneul-0)]

Wasn't clear to me on lightdm - since the light-locker docs/announcements talk about it "relying on lightdm" for the actual locking.

[Theo Linkspfeifer (lastonestanding)]

Now almost three years and several versions later is this security issue still present when using a multi monitor setup?

[Nathan Neulinger (nneul-0)]

Just checked on 16, and it looks like this has been corrected. Behavior now is that it displays a spash screen on every
monitor saying that the session it locked and I will be redirected shortly, then I get the lock screen on all displays.

I'd say this can be closed.

On 8/25/18 4:15 AM, Theo Linkspfeifer wrote:
> Now almost three years and several versions later is this security issue
> still present when using a multi monitor setup?
>
> ** Changed in: light-locker (Ubuntu)
> Status: Triaged => Incomplete
>

--
------------------------------------------------------------
Nathan Neulinger <email address hidden>
Neulinger Consulting [phone]

[Theo Linkspfeifer (lastonestanding)]

Thanks for testing it again.