CVE-2020-16125 gdm3 would start gnome-initial-setup if it cannot contact accountservice
A local attacker can escalate privileges by exploiting a race condition where GDM3 launches initial setup if accountservice is unreachable, allowing creation of privileged accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-16125?
CVE-2020-16125 is a high-severity vulnerability in Gnome GDM3, published on 10 Nov 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
gdm3 versions before 3.36.2 or 3.38.2 would start gnome-initial-setup if gdm3 can't contact the accountservice service via dbus in a timely manner; on Ubuntu (and potentially derivatives) this could be be chained with an additional issue that could allow a local user to create a new privileged account.
Weakness: CWE-754
Which versions are affected by CVE-2020-16125?
It affects 1 product.
Linux distribution packages (22)
gdm SUSE:Enterprise Storage 5 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:HPE Helion OpenStack 8 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Module for Desktop Applications 15 SP1 | All versions | 3.26.2.1-13.39.2 |
gdm SUSE:Linux Enterprise Module for Desktop Applications 15 SP2 | All versions | 3.34.1-8.9.1 |
gdm SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server 12 SP2-LTSS | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server 12 SP5 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:OpenStack Cloud 7 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:OpenStack Cloud 8 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:OpenStack Cloud 9 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:OpenStack Cloud Crowbar 8 | All versions | 3.10.0.1-54.17.2 |
gdm SUSE:OpenStack Cloud Crowbar 9 | All versions | 3.10.0.1-54.17.2 |
gdm openSUSE:Leap 15.1 | All versions | 3.26.2.1-lp151.16.10.1 |
gdm openSUSE:Leap 15.2 | All versions | 3.34.1-lp152.6.9.1 |
Products include Gnome Gnome Display Manager.
How do I fix CVE-2020-16125?
Upgrade to a fixed version.
Is CVE-2020-16125 being exploited?
There is no known exploitation of CVE-2020-16125 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Gnome GDM3
Sources
Also known as DEBIAN-CVE-2020-16125, DLA-2434-1, GHSA-pc8h-hq5p-vf38, MGASA-2021-0003, SUSE-SU-2020:3333-1, SUSE-SU-2020:3614-1 and 5 more.