CVE-2020-27837
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of...
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
- Record
CVE-2020-27837- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
- Record
CVE-2020-27837- Weakness
- CWE-362
- Updated
- 2026-11-02
EUVDEUVD-2020-20336 No score
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
- Record
EUVD-2020-20336- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xpm4-75c2-wrgc No score
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of...
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
- Record
GHSA-xpm4-75c2-wrgc- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
- Record
CVE-2020-27837- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-27837
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
- Record
DEBIAN-CVE-2020-27837- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVOESA-2022-1811
gdm security update
The GNOME Display Manager is a system service that is responsible for providing graphical log-ins and managing local and remote displays, and if the session doesn't provide a display server, GDM will start the display server. It also provides initiate functionality for user-switching, so multiple users can be logged in at the same time.
Security Fix(es):
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.(CVE-2020-27837)
- Record
OESA-2022-1811- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2022-1812
gdm security update
The GNOME Display Manager is a system service that is responsible for providing graphical log-ins and managing local and remote displays, and if the session doesn't provide a display server, GDM will start the display server. It also provides initiate functionality for user-switching, so multiple users can be logged in at the same time.
Security Fix(es):
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.(CVE-2020-27837)
- Record
OESA-2022-1812- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-27837
A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.
- Record
UBUNTU-CVE-2020-27837- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11547-1 No score
gdm-41.0-1.1 on GA media
These are all security issues fixed in the gdm-41.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11547-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gdm3Debian:12 |
before 3.38.2.1-1 | 3.38.2.1-1 |
gdm3Debian:13 |
before 3.38.2.1-1 | 3.38.2.1-1 |
gdm3Debian:14 |
before 3.38.2.1-1 | 3.38.2.1-1 |
gdmopenEuler:20.03-LTS-SP1 |
before 3.38.2.1-1.oe1 | 3.38.2.1-1.oe1 |
gdmopenEuler:20.03-LTS-SP3 |
before 3.38.2.1-1.oe1 | 3.38.2.1-1.oe1 |
gdm3Ubuntu:20.04:LTS |
All versions, plus listed versions 3.34.1-1ubuntu13.36.3-0ubuntu0.20.04.13.36.3-0ubuntu0.20.04.23.36.3-0ubuntu0.20.04.33.36.3-0ubuntu0.20.04.4 |
None known |
gdm3Ubuntu:22.04:LTS |
All versions, plus listed versions 41~rc-0ubuntu241.0-3ubuntu141.0-3ubuntu241.3-1ubuntu141.3-1ubuntu2 Show 10 moreShow less41.3-1ubuntu342.0-1ubuntu142.0-1ubuntu242.0-1ubuntu442.0-1ubuntu642.0-1ubuntu742.0-1ubuntu7.22.04.142.0-1ubuntu7.22.04.242.0-1ubuntu7.22.04.342.0-1ubuntu7.22.04.4 |
None known |
gdmopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 41.0-1.1 | 41.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27837 is a medium vulnerability (CVSS 6.4) in The Gnome Projectr Gdm, published December 28, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in gdm3 3.38.2.1-1.
References
bugzilla.redhat.com/show_bug.cgi?id=1906812
nvd.nist.gov/vuln/detail/CVE-2020-27837
github.com/advisories/GHSA-xpm4-75c2-wrgc
security-tracker.debian.org/tracker/CVE-2020-27837
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1811