Re: Re: LXDM X authentication issues

[Tomas Hoger <thoger () redhat com>]

On Fri, 20 Nov 2015 13:26:53 -0500 (EST) cve-assign () mitre org wrote:

> > LXDM also defaults to not restarting X server between sessions, and
> > does not change authentication cookies or remove xhost authorizations.
> > This allows local user to be able to connect to the X server after they
> > logged out. The 'reset' option in lxdm.conf controls whether X server
> > is restarted on session user close.
>
> This possibly can be included in CVE but, if so, the CVE ID would be
> different. Is there any other information, e.g., why was there a
> decision to make reset an optional behavior rather than a required
> behavior?

Upstream indicated they preferred not to reset to make logout fast and
smooth.  They optimize for single user desktop use case, where this is
not a real concern.

> Is there a possible attack by a different local user, or is the
> relevant attack that someone could steal the computer and recover the
> authentication cookies (possibly violating an expectation of the
> legitimate user who believed they were safely logged out)?

A local user attack.  A local attacker logs in via LXDM.  After that,
they record current authentication cookie, or configure X server to
accept connections based on some other criteria (e.g. allowing all
connections from specific user regardless of whether valid cookie is
provided).  After logging out, attacker can still interact with the X
server - either while it's displaying login prompt, or later when a
different user logs in.  Attacker can monitor screen contents or
keystrokes, or try to make victim interact with their applications and
e.g. enter their credentials into spoofed password prompts.

> Is the behavior different from all major display managers?

Those I tested all started new X server after session logout.

-- 
Tomas Hoger / Red Hat Product Security