A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select login as another user to unlock their screen.
Weakness
This weakness has been deprecated because it covered redundant concepts already described in CWE-287.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gnome_display_manager | Gnome | 3.24.1 (including) | 3.24.1 (including) |
| Gdm3 | Ubuntu | artful | * |
| Gdm3 | Ubuntu | devel | * |
| Gdm3 | Ubuntu | zesty | * |