Date: Fri, 20 Nov 2015 23:19:54 +0100 From: Tomas Hoger <thoger@...hat.com> To: cve-assign@...re.org Cc: oss-security@...ts.openwall.com Subject: Re: Re: LXDM X authentication issues On Fri, 20 Nov 2015 13:26:53 -0500 (EST) cve-assign@...re.org wrote: > > LXDM also defaults to not restarting X server between sessions, and > > does not change authentication cookies or remove xhost authorizations. > > This allows local user to be able to connect to the X server after they > > logged out. The 'reset' option in lxdm.conf controls whether X server > > is restarted on session user close. > > This possibly can be included in CVE but, if so, the CVE ID would be > different. Is there any other information, e.g., why was there a > decision to make reset an optional behavior rather than a required > behavior? Upstream indicated they preferred not to reset to make logout fast and smooth. They optimize for single user desktop use case, where this is not a real concern. > Is there a possible attack by a different local user, or is the > relevant attack that someone could steal the computer and recover the > authentication cookies (possibly violating an expectation of the > legitimate user who believed they were safely logged out)? A local user attack. A local attacker logs in via LXDM. After that, they record current authentication cookie, or configure X server to accept connections based on some other criteria (e.g. allowing all connections from specific user regardless of whether valid cookie is provided). After logging out, attacker can still interact with the X server - either while it's displaying login prompt, or later when a different user logs in. Attacker can monitor screen contents or keystrokes, or try to make victim interact with their applications and e.g. enter their credentials into spoofed password prompts. > Is the behavior different from all major display managers? Those I tested all started new X server after session logout. -- Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ