GNOME gnome-shell CVE-2017-8288 Lock Screen Local Security Bypass Vulnerability

Bugtraq ID:	98070
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-8288
Remote:	No
Local:	Yes
Published:	Apr 26 2017 12:00AM
Updated:	May 02 2017 12:11AM
Credit:	The vendor reported this issue.
Vulnerable:	Redhat Enterprise Linux 7 Offensive Security Kali Linux 2.0 GNOME gnome-shell 3.24.1 GNOME gnome-shell 3.23.2 GNOME gnome-shell 3.23.1 GNOME gnome-shell 3.22
Not Vulnerable:

GNOME gnome-shell CVE-2017-8288 Lock Screen Local Security Bypass Vulnerability

gnome-shell is prone to a local security-bypass vulnerability.

A local attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks.

GNOME gnome-shell 3.22 through 3.24.1 are vulnerable.

GNOME gnome-shell CVE-2017-8288 Lock Screen Local Security Bypass Vulnerability

To exploit this issue, attackers require physical access.

GNOME gnome-shell CVE-2017-8288 Lock Screen Local Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNOME gnome-shell CVE-2017-8288 Lock Screen Local Security Bypass Vulnerability

References:

• extensionSystem: handle reloading broken extensions (GNOME)
  
• GNOME Homepage (GNOME)
  
• Locking Screen sometimes dock and window list will remain in view #46 (EasyScreenCast)
  
• 0002513: Lockscreen doesn't always hide the menus and the dock (Kali)
  
• Bug 1446088 CVE-2017-8288 gnome-shell: Mishandling extensions that fail to reloa (Redhat)
  
• Bug 781728 - Extensions enabled in screenshield if one extension fails to reload (GNOME)