CVE-2020-16125 gdm3 would start gnome-initial-setup if it cannot contact accountservice

2020-11-0600:00:00

CWE-754

canonical

www.cve.org

7.2 High

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.9%

JSON

gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can’t contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a local user to create a new privileged account.

CNA Affected

[
  {
    "product": "GDM3",
    "vendor": "Gnome",
    "versions": [
      {
        "lessThan": "3.36.4",
        "status": "affected",
        "version": "3.36",
        "versionType": "custom"
      },
      {
        "lessThan": "3.38.2",
        "status": "affected",
        "version": "3.38",
        "versionType": "custom"
      }
    ]
  }
]