This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-27837 →
DEBIAN-CVE-2020-27837
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock scree...
Original description
The description as published by the source.
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
gdm3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2.1-1"}]}]
Debian:13
gdm3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2.1-1"}]}]
Debian:14
gdm3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2.1-1"}]}]
References
- advisory security-tracker.debian.org