Description
GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gdm3 | 3.18.2-1 | — |
| Debian 13 | gdm3 | 3.18.2-1 | — |
| Debian 12 | gdm3 | 3.18.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | gdm +1 | 1:3.22.3-11.el7 | RHSA-2017:2128 |
| RHEL 7 | gnome-session +2 | 3.22.3-4.el7 | RHSA-2017:2128 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gdm | 3.22.1-1.2 | openSUSE-SU-2024:10412-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | gdm +1 | 1:3.22.3-11.el7 | ELSA-2017-2128 |
| Oracle Linux 7 | gnome-session +2 | 3.22.3-4.el7 | ELSA-2017-2128 |
Advisories 3
- RHSA-2017:2128 Red Hat Security Advisory: gdm and gnome-session security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- openSUSE-SU-2024:10412-1 gdm-3.22.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2017-2128 Moderate: gdm and gnome-session security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Aug 7, 2017
References
- FEDORA-2015-271025c598 vendor-advisory
- [oss-security] 20151117 Re: CVE request for Gnome gdm/screen lock crash mailing-list
- RHSA-2017:2128 vendor-advisory
- https://download.gnome.org/sources/gdm/3.18/gdm-3.18.2.news
- https://bugzilla.gnome.org/show_bug.cgi?id=758032
- [oss-security] 20151117 CVE request for Gnome gdm/screen lock crash mailing-list