一、漏洞信息

漏洞编号：[CVE-2020-27837](https://nvd.nist.gov/vuln/detail/CVE-2020-27837)

漏洞归属组件：[gdm](https://gitee.com/src-openeuler/gdm)

漏洞归属的版本：3.38.2.1

CVSS V3.0分值：

BaseScore：6.4 Medium

Vector：CVSS：3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

漏洞简述：

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.

漏洞公开时间：2020-12-28

漏洞创建时间：2022-07-13 14:06:38

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2020-27837

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

一、漏洞信息

漏洞编号：[CVE-2020-27837](https://nvd.nist.gov/vuln/detail/CVE-2020-27837)

漏洞归属组件：[gdm](https://gitee.com/src-openeuler/gdm)

漏洞归属的版本：3.38.2.1

CVSS V3.0分值：

BaseScore：6.4 Medium

Vector：CVSS：3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

漏洞简述：

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.

漏洞公开时间：2020-12-28

漏洞创建时间：2022-07-13 14:06:38

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2020-27837

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

6.4

Vector：CVSS：3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响)：

一、漏洞信息

漏洞编号：[CVE-2020-27837](https://nvd.nist.gov/vuln/detail/CVE-2020-27837)

漏洞归属组件：[gdm](https://gitee.com/src-openeuler/gdm)

漏洞归属的版本：3.38.2.1

CVSS V3.0分值：

BaseScore：6.4 Medium

Vector：CVSS：3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

漏洞简述：

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.

漏洞创建时间：2022-07-13 14:06:38

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2020-27837

漏洞分析指导链接：

https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md

漏洞数据来源:

其它

漏洞补丁信息：

<details>

<summary>详情</summary>

无

</details>

二、漏洞分析结构反馈

影响性分析说明：

openEuler评分：

6.4

Vector：CVSS：3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

受影响版本排查(受影响/不受影响)：

1.openEuler-20.03-LTS-SP1(3.30.1):受影响

2.openEuler-20.03-LTS-SP3(3.30.1):受影响

3.openEuler-22.03-LTS(3.38.2.1):不受影响

4.openEuler-22.03-LTS-Next(3.38.2.1):不受影响

5.master(3.38.2.1):不受影响

修复是否涉及abi变化(是/否)：

1.openEuler-20.03-LTS-SP1(3.30.1):是

2.openEuler-20.03-LTS-SP3(3.30.1):是

3.openEuler-22.03-LTS(3.38.2.1):否

4.openEuler-22.03-LTS-Next(3.38.2.1):否

5.master(3.38.2.1):否

一、漏洞信息

漏洞编号：[CVE-2020-27837](https://nvd.nist.gov/vuln/detail/CVE-2020-27837)

漏洞归属组件：[gdm](https://gitee.com/src-openeuler/gdm)

漏洞归属的版本：3.38.2.1

CVSS V3.0分值：

BaseScore：6.4 Medium

Vector：CVSS：3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

漏洞简述：

A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit.

漏洞公开时间：2020-12-29 03:15

漏洞创建时间：2022-07-13 14:06:38

漏洞详情参考链接：

https://nvd.nist.gov/vuln/detail/CVE-2020-27837