CVE-2020-16125

Name of the Vulnerable Software and Affected Versions gdm3 versions before 3.36.2 or 3.38.2

Description The issue allows a local user to potentially create a new privileged account on Ubuntu and its derivatives by exploiting a vulnerability in the GNOME Display Manager (GDM) when it cannot contact the accountservice service via dbus in a timely manner. This can be chained with another issue to achieve privilege escalation. The vulnerability is resolved in GNOME 3.36.2 and 3.38.2.

Recommendations For gdm3 versions before 3.36.2, update to version 3.36.2 or later. For gdm3 versions before 3.38.2, update to version 3.38.2 or later. As a temporary workaround, consider restricting access to the accountservice service via dbus to minimize the risk of exploitation.