Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[also affects Mint 17] [CVE-2014-1949]cinnamon-screensaver lock bypass (tested on Fedora 20) #44

Closed
leigh123linux opened this issue Feb 13, 2014 · 11 comments

Comments

@leigh123linux
Copy link
Contributor

I can't reproduce the issue in mint so it might be systemd related

http://seclists.org/oss-sec/2014/q1/327

@leigh123linux
Copy link
Contributor Author

Here's the debug output.

http://pastebin.com/raw.php?i=7Ldbytmw

[leigh@main-pc ~]$ killall cinnamon
cinnamon                        cinnamon-session
cinnamon-fallback-mount-helper  cinnamon-settings-daemon
cinnamon-screensaver            
[leigh@main-pc ~]$ killall cinnamon-screensaver
[leigh@main-pc ~]$ killall cinnamon-screensaver
cinnamon-screensaver: no process found
[leigh@main-pc ~]$ cinnamon-screensaver --help
Usage:
  cinnamon-screensaver [OPTION…]

Help Options:
  -h, --help               Show help options
  --help-all               Show all help options
  --help-gtk               Show GTK+ Options

Application Options:
  --version                Version of this application
  --no-daemon              Don't become a daemon
  --debug                  Enable debugging code
  --display=DISPLAY        X display to use

[leigh@main-pc ~]$ cinnamon-screensaver --debug
[gs_debug_init] gs-debug.c:106 (11:43:12):   Debugging enabled
[main] cinnamon-screensaver.c:86 (11:43:12):     initializing cinnamon-screensaver 2.0.3
[init_session_id] gs-listener-dbus.c:1512 (11:43:12):    Got session-id: 1
[gs_fade_init] gs-fade.c:920 (11:43:12):     Fade type: 3
[set_status] gs-watcher-x11.c:284 (11:43:12):    GSWatcher: not active, ignoring status changes
[gs_watcher_set_active] gs-watcher-x11.c:215 (11:43:12):     turning watcher: ON
[listener_dbus_handle_system_message] gs-listener-dbus.c:892 (11:43:12):     obj_path=/org/freedesktop/DBus interface=org.freedesktop.DBus method=NameAcquired destination=:1.52
[on_bg_changed] gs-manager.c:525 (11:43:12):     background changed
[gs_manager_set_lock_active] gs-manager.c:128 (11:43:17):    Setting lock active: 1
[gs_grab_grab_root] gs-grab-x11.c:536 (11:43:17):    Grabbing the root window
[gs_grab_get_keyboard] gs-grab-x11.c:153 (11:43:17):     Grabbing keyboard widget=291
[gs_grab_get_mouse] gs-grab-x11.c:188 (11:43:17):    Grabbing mouse widget=291
[gs_manager_create_windows_for_screen] gs-manager.c:1136 (11:43:17):     Creating 1 windows for screen 0
[gs_manager_create_window_for_monitor] gs-manager.c:960 (11:43:17):  Creating window for monitor 0 [0,0] (1920x1080)
[update_geometry] gs-window-x11.c:297 (11:43:17):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:17):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:17):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:17):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:17):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:17):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:17):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:17):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:17):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:17):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:17):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[window_map_cb] gs-manager.c:742 (11:43:17):     Handling window map event
[window_show_cb] gs-manager.c:814 (11:43:17):    Handling window show
[apply_background_to_window] gs-manager.c:775 (11:43:17):    Creating background w:1920 h:1080
[gs_watcher_set_active] gs-watcher-x11.c:215 (11:43:17):     turning watcher: OFF
[gs_listener_send_signal_active_changed] gs-listener-dbus.c:185 (11:43:17):  Sending the ActiveChanged(TRUE) signal on the session bus
[gs_window_xevent] gs-window-x11.c:548 (11:43:17):   not raising our windows
[window_map_event_cb] gs-manager.c:731 (11:43:17):   Handling window map_event event
[manager_maybe_grab_window] gs-manager.c:685 (11:43:17):     Moving grab to 0x25de380
[xorg_lock_smasher_set_active] gs-grab-x11.c:101 (11:43:17):     No XFree86-Misc extension present
[gs_grab_move_keyboard] gs-grab-x11.c:343 (11:43:17):    Moving keyboard grab from 291 to 260000D
[gs_grab_move_keyboard] gs-grab-x11.c:350 (11:43:17):    *** doing X server grab
[gs_grab_release_keyboard] gs-grab-x11.c:226 (11:43:17):     Ungrabbing keyboard
[gs_grab_get_keyboard] gs-grab-x11.c:153 (11:43:17):     Grabbing keyboard widget=260000D
[gs_grab_move_keyboard] gs-grab-x11.c:372 (11:43:17):    *** releasing X server grab
[gs_grab_move_mouse] gs-grab-x11.c:288 (11:43:17):   Moving pointer grab from 291 to 260000D
[gs_grab_move_mouse] gs-grab-x11.c:295 (11:43:17):   *** doing X server grab
[gs_grab_release_mouse] gs-grab-x11.c:249 (11:43:17):    Ungrabbing pointer
[gs_grab_get_mouse] gs-grab-x11.c:188 (11:43:17):    Grabbing mouse widget=260000D
[gs_grab_move_mouse] gs-grab-x11.c:318 (11:43:17):   *** releasing X server grab
[set_status] gs-watcher-x11.c:284 (11:43:17):    GSWatcher: not active, ignoring status changes
[listener_dbus_handle_system_message] gs-listener-dbus.c:892 (11:43:17):     obj_path=/org/freedesktop/login1/session/_31 interface=org.freedesktop.DBus.Properties method=PropertiesChanged destination=(null)
[listener_dbus_handle_system_message] gs-listener-dbus.c:892 (11:43:17):     obj_path=/org/freedesktop/login1/seat/seat0 interface=org.freedesktop.DBus.Properties method=PropertiesChanged destination=(null)
[listener_dbus_handle_system_message] gs-listener-dbus.c:892 (11:43:17):     obj_path=/org/freedesktop/login1/user/_1000 interface=org.freedesktop.DBus.Properties method=PropertiesChanged destination=(null)
[gs_window_raise] gs-window-x11.c:496 (11:43:17):    Raising screensaver window
[gs_window_raise] gs-window-x11.c:496 (11:43:17):    Raising screensaver window
[listener_dbus_handle_system_message] gs-listener-dbus.c:892 (11:43:17):     obj_path=/org/freedesktop/login1 interface=org.freedesktop.DBus.Properties method=PropertiesChanged destination=(null)
[update_geometry] gs-window-x11.c:297 (11:43:17):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:17):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:17):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:17):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:17):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:17):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[unfade_idle] gs-manager.c:712 (11:43:17):   resetting fade
[gs_fade_reset] gs-fade.c:861 (11:43:17):    Resetting fade
[update_geometry] gs-window-x11.c:297 (11:43:19):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:19):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:19):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:19):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:19):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:19):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:20):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:20):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:20):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:20):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:20):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:20):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:21):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:21):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:21):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:21):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:21):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:21):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[find_window_at_pointer] gs-manager.c:644 (11:43:22):    Requesting unlock for screen 0
[gs_window_request_unlock] gs-window-x11.c:1486 (11:43:22):  Requesting unlock
[window_dialog_up_changed_cb] gs-manager.c:885 (11:43:22):   Handling window dialog up changed: up
[handle_window_dialog_up] gs-manager.c:827 (11:43:22):   Handling dialog up
[xorg_lock_smasher_set_active] gs-grab-x11.c:101 (11:43:22):     No XFree86-Misc extension present
[gs_grab_move_keyboard] gs-grab-x11.c:336 (11:43:22):    Window 260000D is already grabbed, skipping
[gs_grab_move_mouse] gs-grab-x11.c:276 (11:43:22):   Window 260000D is already grabbed, skipping
[gs_grab_release_mouse] gs-grab-x11.c:249 (11:43:22):    Ungrabbing pointer
[gs_window_xevent] gs-window-x11.c:548 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:548 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:548 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:548 (11:43:22):   not raising our windows
[gs_window_real_grab_broken] gs-window-x11.c:1906 (11:43:22):    Grab broken on window 260000D pointer, new grab on window 2600020
[window_grab_broken_cb] gs-manager.c:701 (11:43:22):     GRAB BROKEN!
[popup_dialog] gs-window-x11.c:1430 (11:43:22):  Popping up dialog
[gs_window_clear_to_background_surface] gs-window-x11.c:232 (11:43:22):  Clearing window to background pixmap
[gs_window_real_grab_broken] gs-window-x11.c:1906 (11:43:22):    Grab broken on window 260000D keyboard, new grab on window 2600020
[window_grab_broken_cb] gs-manager.c:701 (11:43:22):     GRAB BROKEN!
[error_watch] gs-window-x11.c:810 (11:43:22):    command error output: [gs_debug_init] gs-debug.c:106 (11:43:22):    Debugging enabled

[error_watch] gs-window-x11.c:810 (11:43:22):    command error output: 

[error_watch] gs-window-x11.c:810 (11:43:22):    command error output: (cinnamon-screensaver-dialog:2214): GLib-GObject-WARNING **: invalid cast from 'GtkBox' to 'GtkMisc'

[error_watch] gs-window-x11.c:810 (11:43:22):    command error output: 

[error_watch] gs-window-x11.c:810 (11:43:22):    command error output: (cinnamon-screensaver-dialog:2214): Gtk-CRITICAL **: gtk_misc_set_alignment: assertion 'GTK_IS_MISC (misc)' failed

[error_watch] gs-window-x11.c:810 (11:43:22):    command error output: [auth_message_handler] cinnamon-screensaver-dialog.c:220 (11:43:22):  Got message style 1: 'Password: '

[gs_window_raise] gs-window-x11.c:496 (11:43:22):    Raising screensaver window
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[lock_command_watch] gs-window-x11.c:1335 (11:43:22):    command output: WINDOW ID=58720266

[error_watch] gs-window-x11.c:810 (11:43:22):    command error output: [gs_lock_plug_enable_prompt] gs-lock-plug.c:1299 (11:43:22):  Setting prompt to: Password:

[gs_window_xevent] gs-window-x11.c:548 (11:43:22):   not raising our windows
[update_geometry] gs-window-x11.c:297 (11:43:22):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:22):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:22):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:22):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:22):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:22):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:548 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:548 (11:43:22):   not raising our windows
[update_geometry] gs-window-x11.c:297 (11:43:22):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:22):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:22):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:22):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:22):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:22):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[gs_window_xevent] gs-window-x11.c:560 (11:43:22):   not raising our windows
[update_geometry] gs-window-x11.c:297 (11:43:23):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:310 (11:43:23):    using geometry for monitor 0: x=0 y=0 w=1920 h=1080
[gs_window_move_resize_window] gs-window-x11.c:343 (11:43:23):   Move and/or resize window on monitor 0: x=0 y=0 w=1920 h=1080
[update_geometry] gs-window-x11.c:297 (11:43:23):    got geometry for monitor 0: x=0 y=0 w=1920 h=1080

@clefebvre
Copy link
Member

[gs_window_real_grab_broken] gs-window-x11.c:1906 (11:43:22): Grab broken on window 260000D keyboard, new grab on window 2600020
[window_grab_broken_cb] gs-manager.c:701 (11:43:22): GRAB BROKEN!

That looks relevant.

@clefebvre
Copy link
Member

Hi,

We fixed something that could relate to this today. Please re-test with git-latest, it could potentially fix this problem.

@leigh123linux leigh123linux changed the title cinnamon-screensaver lock bypass (tested on Fedora 20) [also affects Mint 17] cinnamon-screensaver lock bypass (tested on Fedora 20) May 11, 2014
@leigh123linux
Copy link
Contributor Author

I can also reproduce on Mint 17

leigh@leigh-GA-990XA-UD3 / $ dpkg -l cinnamon*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version      Architecture Description
+++-==============-============-============-=================================
iU  cinnamon       2.2.7+qiana  amd64        Cinnamon desktop
ii  cinnamon-bluet 3.8.4+qiana  amd64        Gnome Bluetooth support for the C
un  cinnamon-cappl <none>       <none>       (no description available)
iU  cinnamon-commo 2.2.7+qiana  all          Cinnamon desktop (Common data fil
ii  cinnamon-contr 2.2.7+qiana  amd64        utilities to configure the Cinnam
ii  cinnamon-contr 2.2.7+qiana  all          configuration applets for Cinnamo
iU  cinnamon-deskt 2.2.2+qiana  all          Common files for Cinnamon desktop
ii  cinnamon-scree 2.2.3+qiana  amd64        Cinnamon screen saver and locker
ii  cinnamon-sessi 2.2.1+qiana  amd64        Cinnamon Session Manager - Minima
ii  cinnamon-sessi 2.2.1+qiana  all          Cinnamon Session Manager - common
ii  cinnamon-setti 2.2.2+qiana  amd64        daemon handling the Cinnamon sess
ii  cinnamon-theme 2014.04.10   all          Cinnamon themes
ii  cinnamon-trans 2.2.2+qiana  all          Translation files for the Cinnamo

https://dl.dropboxusercontent.com/u/6907158/cinnamon-20140511-2.webm

@laurento
Copy link

This issue is known as CVE-2014-1949 (just to make the search easier).

@leigh123linux leigh123linux changed the title [also affects Mint 17] cinnamon-screensaver lock bypass (tested on Fedora 20) [also affects Mint 17] [CVE-2014-1949]cinnamon-screensaver lock bypass (tested on Fedora 20) May 14, 2014
@Fantu
Copy link
Contributor

Fantu commented Jun 6, 2014

Any news about this?

Thanks for any reply.

@Fantu
Copy link
Contributor

Fantu commented Jul 19, 2014

I tried to reproduce it on Sid with latest updates and I was unable to reproduce it (I'm unable to see the menu with screensaver with key that show menu without screensaver).
I did something wrong or one of many debian changes have solved also this problem?

Thanks for any reply.

corbin-auriti added a commit to corbin-auriti/cinnamon-screensaver that referenced this issue Jul 19, 2014
@Fantu
Copy link
Contributor

Fantu commented Jul 20, 2014

one debian developer have found that is fixed in gtk:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=738828
After a while checking the issue, we could reproduce the issue installing the gtk 3.10 and it's solved with gtk 3.12.
Using the packages from snapshots, the problem is reproduceable with gtk 3.10.7 and is fixed in 3.11.5. We haven't yet found the exact fix.

@mtwebster
Copy link
Member

See mtwebster@da7af55 for an isolated patch for cinnamon-screensaver, which prevents an un-fixed gtk from ever receiving a popup_menu.

@mtwebster
Copy link
Member

By the way, up until now, I was of the understanding that the 'menu' key being discussed was Cinnamon's menu key, NOT the vestigial context menu key that some keyboards lack today. As a result, many of us were unable to reproduce the issue, and ignored it.

An issue as critical as this, _too much information is _far* preferred over just enough* - it could have saved us a lot of time.

@clefebvre
Copy link
Member

Here's the fix in GTK: https://mail.gnome.org/archives/commits-list/2014-January/msg03294.html

There's no fix needed in cinnamon-screensaver itself so I'm closing the issue.

In Mint this GTK fix is going through Romeo and should be applied in the main repositories in a matter of days.

PS: the "Menu" key for me meant the Super_L key... I didn't understand we were talking about the physical "Properties" key on the keyboard... we could have reproduced and probably fixed that a long time ago :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants