Red Hat Enterprise Linux 7 update for GNOME

1) Security restrictions bypass

EUVDB-ID: #VU17709

Risk: Medium

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-3820

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a physical attacker to bypass security restrictions on the system.

The vulnerability exists due to the lock screen feature does not properly restrict all contextual actions. A physical attacker can click on the password text field to bypass the lock screen and re-enable certain keyboard shortcuts, which the attacker can use to perform unauthorized actions on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat Enterprise Linux for Power, little endian: 7

Red Hat Enterprise Linux for Power, big endian: 7

Red Hat Enterprise Linux for IBM z Systems: 7

Red Hat Enterprise Linux for Scientific Computing: 7

Red Hat Enterprise Linux Desktop: 7

Red Hat Enterprise Linux Workstation: 7

Red Hat Enterprise Linux Server: 7

xchat (Red Hat package): before 2.8.8-25.el7

tracker (Red Hat package): before 1.10.5-8.el7

shared-mime-info (Red Hat package): before 1.8-5.el7

osinfo-db (Red Hat package): before 20190805-2.el7

nautilus (Red Hat package): before 3.26.3.1-7.el7

mutter (Red Hat package): before 3.28.3-20.el7

libgweather (Red Hat package): before 3.28.2-3.el7

libcanberra (Red Hat package): before 0.30-9.el7

gtk3 (Red Hat package): before 3.22.30-5.el7

gsettings-desktop-schemas (Red Hat package): before 3.28.0-3.el7

gnome-tweak-tool (Red Hat package): before 3.28.1-7.el7

gnome-shell-extensions (Red Hat package): before 3.28.1-11.el7

gnome-shell (Red Hat package): before 3.28.3-24.el7

gnome-settings-daemon (Red Hat package): before 3.28.1-8.el7

gnome-online-accounts (Red Hat package): before 3.28.2-1.el7

gdm (Red Hat package): before 3.28.2-22.el7

control-center (Red Hat package): before 3.28.1-6.el7

colord (Red Hat package): before 1.3.4-2.el7

accountsservice (Red Hat package): before 0.6.50-7.el7

LibRaw (Red Hat package): before 0.19.4-1.el7

CPE2.3

• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_little_endian:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_power_big_endian:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_ibm_z_systems:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_for_scientific_computing:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_desktop:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_workstation:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:o:red_hat:red_hat_enterprise_linux_server:7:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:xchat_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:tracker_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:shared-mime-info_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:osinfo-db_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:nautilus_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:mutter_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:libgweather_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:libcanberra_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gtk3_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gsettings-desktop-schemas_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gnome-tweak-tool_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gnome-shell-extensions_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gnome-shell_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gnome-settings-daemon_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gnome-online-accounts_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:gdm_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:control-center_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:colord_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:accountsservice_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*
• cpe:2.3:a:red_hat:libraw_redhat_package:*:*:*:*:*:red_hat_enterprise_linux:*:*

External links

https://access.redhat.com/errata/RHSA-2020:1021

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.