USN-4614-1: GDM vulnerability

Releases

• Ubuntu 20.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• gdm3 - GNOME Display Manager

Details

Kevin Backhouse discovered that GDM incorrectly launched the initial setup
tool when the accountsservice daemon was not reachable. A local attacker
able to cause accountsservice to crash or stop responding could trick GDM
into launching the initial setup tool and create a privileged user.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.10

• gdm3 - 3.38.1-2ubuntu1.1

Ubuntu 20.04

• gdm3 - 3.36.3-0ubuntu0.20.04.2

Ubuntu 18.04

• gdm3 - 3.28.3-0ubuntu18.04.6

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

• CVE-2020-16125