High severity · published Apr 27, 2017
CVE-2017-8288
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen
8.1
CVSS
2.9%
EPSS
No
On KEV
Description
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnome-shell · Gnome
3.22.0; 3.22.1; 3.22.2; 3.22.3; 3.23.1; 3.23.2; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-8288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-8288
Third Party Advisory
http://www.securityfocus.com/bid/98070
Issue Tracking
https://bugs.kali.org/view.php?id=2513
Issue Tracking
https://bugzilla.gnome.org/show_bug.cgi?id=781728
Third Party Advisory
https://github.com/EasyScreenCast/EasyScreenCast/issues/46
Issue Tracking
https://github.com/GNOME/gnome-shell/commit/ff425d1db7082e2755d2a405af53861552acf2a1
More from Gnome-shell
6.1
CVE-2021-20315
A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are…
5.5
CVE-2023-43090
A vulnerability was found in GNOME Shell
5.5
CVE-2021-3982
Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue
4.3
CVE-2020-17489
An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4
4.3
CVE-2019-3820
It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions