CVE-2020-27837

low-risk
Published 2020-12-28

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.4/10 Medium
PHYSICAL / HIGH complexity

Affected Products (1)

Gnome Display Manager

Affected Vendors

Gnome

References (2)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1906812
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1906812
22
/ 100
low-risk
Severity 17/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal