Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file

To: Salvatore Bonaccorso <carnil@debian.org>
Cc: 973748@bugs.debian.org, Debian FTP Masters <ftpmaster@ftp-master.debian.org>, dak@security.debian.org
Subject: Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
From: Norbert Preining <norbert@preining.info>
Date: Thu, 5 Nov 2020 21:15:15 +0900
Message-id: <[🔎] 20201105121515.GC36413@bulldog.preining.info>
Reply-to: Norbert Preining <norbert@preining.info>, 973748@bugs.debian.org
In-reply-to: <[🔎] 20201105120719.GA15469@lorien.valinor.li>
References: <E1kacqJ-0003c5-ND@seger.debian.org> <[🔎] 160449433254.22150.933936578574498063.reportbug@lorien.valinor.li> <[🔎] 20201105112607.GA36413@bulldog.preining.info> <[🔎] 160449433254.22150.933936578574498063.reportbug@lorien.valinor.li> <[🔎] 20201105114327.GA12819@lorien.valinor.li> <[🔎] 20201105115540.GB36413@bulldog.preining.info> <[🔎] 20201105120719.GA15469@lorien.valinor.li> <[🔎] 160449433254.22150.933936578574498063.reportbug@lorien.valinor.li>

Hi Salvatore,

On Thu, 05 Nov 2020, Salvatore Bonaccorso wrote:
> to day, this is the debdiff I just used for the upload. tracker.d.o
> does not show it yet because the packages are sitting in the embargoed
> policy queue on security-master so not yet pushed out to the archive.

Ah, ok, didn't know that. Fine with me!

> No not for buster-security. But I can provide you the two commits for
> the packaging repo if you prefer that instead of importing the dsc.
> They are attached.

Thanks, that is great. I will trash my branch and make a new one based
on your commit. I wait with tagging until I see the package appear.

Best regards

Norbert

--
PREINING Norbert                              https://www.preining.info
Accelia Inc. + IFMGA ProGuide + TU Wien + JAIST + TeX Live + Debian Dev
GPG: 0x860CDC13   fp: F7D8 A928 26E3 16A1 9FA0 ACF0 6CAC A448 860C DC13

Reply to:

Follow-Ups:
- Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
  - From: Salvatore Bonaccorso <carnil@debian.org>

References:
- Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
  - From: Salvatore Bonaccorso <carnil@debian.org>
- Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
  - From: Norbert Preining <norbert@preining.info>
- Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
  - From: Salvatore Bonaccorso <carnil@debian.org>
- Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
  - From: Norbert Preining <norbert@preining.info>
- Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
  - From: Salvatore Bonaccorso <carnil@debian.org>

Prev by Date: Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
Next by Date: Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
Previous by thread: Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
Next by thread: Bug#973748: sddm: CVE-2020-28049: local privilege escalation due to race condition in creation of the Xauthority file
Index(es):
- Date
- Thread