CVE-2017-12164

Publication date 26 July 2018

Last updated 25 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

6.4 · Medium

Score breakdown

Description

A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen.

Read the notes from the security team

Status

Package Ubuntu Release Status
gdm3 17.10 artful
Fixed 3.26.0-1ubuntu1
17.04 zesty
Fixed 3.24.1-0ubuntu0.2
16.04 LTS xenial
Not affected
14.04 LTS trusty Not in release

Notes

leosilva

according with RHEL it's a side effect introduced in gdm-3.24.1 affecting only artful and zesty.

mdeslaur

introduced by ff98b2817014684ae1acec78ff06f0f461a56a9f

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
gdm3

Severity score breakdown

Parameter Value
Base score 6.4 · Medium
Attack vector Physical
Attack complexity High
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Other references