CVE-2020-27837 Race condition in gdm

What is CVE-2020-27837?

CVE-2020-27837 is a medium-severity vulnerability in gdm, published on 28 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.

Weakness: CWE-362

Which versions are affected by CVE-2020-27837?

It affects 1 product.

Products include Gnome Gnome Display Manager.

How do I fix CVE-2020-27837?

Upgrade to a fixed version.

Is CVE-2020-27837 being exploited?

There is no known exploitation of CVE-2020-27837 in the wild and no public exploit code.

Other vulnerabilities in gdm

• CVE-2018-14424 Use after free in n/a High 7.8
• CVE-2020-16125 gdm3 would start gnome-initial-setup if it cannot contact accountservice High 7.2
• CVE-2013-4169 Path traversal in n/a Medium 6.9
• CVE-2017-12164 Auth bypass in gdm Medium 4.1
• CVE-2013-7273 Denial of service in n/a Low 2.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-27837, GHSA-xpm4-75c2-wrgc, OESA-2022-1811, OESA-2022-1812, UBUNTU-CVE-2020-27837.