Locked session becomes temporarily visible during user switch
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| gnome-screensaver (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Bug Description
Binary package hint: gnome-screensaver
Hello,
If I select System > Quit > Switch User, my session locks and I am presented with the login screen.
When I select Quit from the login screen, my monitor briefly goes black, my desktop is fully redrawn (this takes one full second on my PC) and then my screen saver is displayed. This behaviour can also be exhibited by locking the session, switching to another TTY (regardless of its content) and then switching back.
As my session is locked, I would expect my desktop not to be displayed under any circumstance besides correct entry of my password. I have marked this as a security vulnerability since a user's desktop may be displaying sensitive information at the time that it is locked, and it is possible to glance at that information without unlocking the desktop.
| Kees Cook (kees) wrote | #1 |
| Changed in gnome-screensaver: | |
| status: | Unconfirmed → Needs Info |
| Daniel Holbach (dholbach) wrote | #2 |
| Changed in gnome-screensaver: | |
| status: | Needs Info → Rejected |
| Alex Peters (alex-peters) wrote | #3 |
Thank you for your report. To help debug the situation, which version of Ubuntu are you running?