Note:
This project will be discontinued after December 13, 2021. [more]
2018-07-17
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
Products | Sddm |
Type | Permissions, Privileges, and Access Controls (CWE-264) |
First patch |
https://github.com/sddm/sddm/commit/147cec383892d143b5e02daa70f1e7def50f5d98 |
Relevant file/s |
• ./src/daemon/Display.cpp (modified, +3, -1)
• ./src/helper/backend/PamBackend.cpp (modified, -2) |
Links | https://bugzilla.suse.com/show_bug.cgi?id=1101450 |
Navigation
Patch data:
Patched area:
(on by default)
Patched area: