Vulnerability Description
An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus can therefore unlock any graphical session. This is related to daemon/Display.cpp and helper/backend/PamBackend.cpp.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sddm Project | Sddm | <= 0.17.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.suse.com/show_bug.cgi?id=1101450Issue TrackingPatchThird Party Advisory
- https://github.com/sddm/sddm/commit/147cec383892d143b5e02daa70f1e7def50f5d98PatchThird Party Advisory
- https://bugzilla.suse.com/show_bug.cgi?id=1101450Issue TrackingPatchThird Party Advisory
- https://github.com/sddm/sddm/commit/147cec383892d143b5e02daa70f1e7def50f5d98PatchThird Party Advisory
FAQ
What is CVE-2018-14345?
CVE-2018-14345 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in SDDM through 0.17.0. If configured with ReuseSession=true, the password is not checked for users with an already existing session. Any user with access to the system D-Bus c...
How severe is CVE-2018-14345?
CVE-2018-14345 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-14345?
Check the references section above for vendor advisories and patch information. Affected products include: Sddm Project Sddm.