GNOME gnome-shell CVE-2019-3820 Lock Screen Local Security Bypass Vulnerability

Bugtraq ID:	107305
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2019-3820
Remote:	No
Local:	Yes
Published:	Jan 25 2019 12:00AM
Updated:	Jan 25 2019 12:00AM
Credit:	Ray Strode (The GNOME Project)
Vulnerable:	Redhat Enterprise Linux 7 GNOME gnome-shell 3.15.91
Not Vulnerable:

GNOME gnome-shell CVE-2019-3820 Lock Screen Local Security Bypass Vulnerability

GNOME gnome-shell is prone to a local security-bypass vulnerability.

A local attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

GNOME gnome-shell 3.15.91 is vulnerable; other versions may also be affected.

GNOME gnome-shell CVE-2019-3820 Lock Screen Local Security Bypass Vulnerability

To exploit this issue, attackers require physical access.

GNOME gnome-shell CVE-2019-3820 Lock Screen Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNOME gnome-shell CVE-2019-3820 Lock Screen Local Security Bypass Vulnerability

References:

• GNOME Homepage (GNOME)
  
• Bug 1669391 (CVE-2019-3820) - CVE-2019-3820 gnome-shell: partial lock screen by ()
  
• Bug 745039 - can't take a screenshot of background menu ()
  
• popupMenu: Use TOPBAR_POPUP action mode for all menus ()
  
• CVE-2019-3820 ()
  
• Partial screen lock bypass via keybindings? ()