Ubuntu's Gnome desktop could be tricked into giving root access

guest · Nov 10, 2020

Ubuntu's Gnome desktop could be tricked into giving root access
November 10, 2020
https://www.bleepingcomputer.com/ne...top-could-be-tricked-into-giving-root-access/

A vulnerability in GNOME Display Manager (gdm) could allow a standard user to create accounts with increased privileges, giving a local attacker a path to run code with administrator permissions (root).

Although certain conditions are necessary, the bug is easy to exploit. The process involves running a few simple commands in the terminal and modifying general system settings that do not require increased rights.
Add new admin
Exploiting the bug in gdm3 takes advantage of crashing the AccountsService component, which keeps track of the users available on the system.

Besides handling the graphical display managers, gdm3 is also responsible for showing the user login interface on Unix-like operating systems.
Click to expand...

However, Backhouse discovered two vulnerabilities in AccountsService that caused the component to hang (CVE-2020-16127) and drop user account privileges (CVE-2020-16126), allowing a standard user to crash the daemon by sending it a delayed segmentation fault signal (kill -SIGSEGV).

Without the AccountsService running, gdm3 has no clue about the accounts present on the machine and provides the option to create a new one with root privileges, as in the case of a first-time setup.
Click to expand...

This bug is now tracked as CVE-2020-16125 and rated with a high severity score of 7.2 out of 10. It affects Ubuntu 20.10, Ubuntu 20.04, and Ubuntu 18.04.
Click to expand...

How to get root on Ubuntu 20.04 by pretending nobody’s /home

Log in or Sign up

Ubuntu's Gnome desktop could be tricked into giving root access

guest Guest

Log in or Sign up

Ubuntu's Gnome desktop could be tricked into giving root access

guest Guest

Useful Searches