openEuler update for gnome-shell

1) Security restrictions bypass

EUVDB-ID: #VU17709

Risk: Medium

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-3820

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a physical attacker to bypass security restrictions on the system.

The vulnerability exists due to the lock screen feature does not properly restrict all contextual actions. A physical attacker can click on the password text field to bypass the lock screen and re-enable certain keyboard shortcuts, which the attacker can use to perform unauthorized actions on the system.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

openEuler: 20.03 LTS SP1 - 20.03 LTS SP2

gnome-shell-help: before 3.30.1-10

gnome-shell-debuginfo: before 3.30.1-10

gnome-shell-debugsource: before 3.30.1-10

gnome-shell: before 3.30.1-10

CPE2.3

• cpe:2.3:o:openeuler:openeuler:20.03:LTS SP1:*:*:*:*:*:*
• cpe:2.3:o:openeuler:openeuler:20.03:LTS SP2:*:*:*:*:*:*
• cpe:2.3:a:openeuler:gnome-shell-help:*:*:*:*:*:openeuler:*:*
• cpe:2.3:a:openeuler:gnome-shell-debuginfo:*:*:*:*:*:openeuler:*:*
• cpe:2.3:a:openeuler:gnome-shell-debugsource:*:*:*:*:*:openeuler:*:*
• cpe:2.3:a:openeuler:gnome-shell:*:*:*:*:*:openeuler:*:*

External links

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1403

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.