Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information

From	Vincent Lefevre <vincent@vinc17.net>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information
Date	2020-03-29 21:50 +0200
Message-ID	<zPM6u-5yQ-3@gated-at.bofh.it> (permalink)
References	<y8VwZ-1QA-7@gated-at.bofh.it> <zPJLj-4f5-1@gated-at.bofh.it> <y8VwZ-1QA-7@gated-at.bofh.it> <zPJLj-4f5-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On 2020-03-29 19:10:30 +0200, Ivo De Decker wrote:
> On Fri, Jun 14, 2019 at 04:31:16PM +0200, Vincent Lefevre wrote:
> > When logging out, a part of the previous session is still visible.
> > This might be used to compromise the user's account or leak other
> > private information, depending on what was written on the screen.
> 
> What do you mean exactly? Is the screen only erased partially, or not at all?

It was partially erased.

> Is there something specific about your setup that you think might be relevant
> here?

I don't think so, except the use of the nouveau driver, of course.
But there were no issues for years. I think that problems started
to occur after some kernel upgrade. Now, I haven't had any problem
since December, I think.

> Also, I don't think this bug is really 'grave'. Even if private information
> remains on the screen, the user can see that, and take action to avoid it.

Not if one logs out remotely.

Regards,

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information Vincent Lefevre <vincent@vinc17.net> - 2020-03-29 21:50 +0200
  Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information Vincent Lefevre <vincent@vinc17.net> - 2020-03-30 13:10 +0200
    Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information Ivo De Decker <ivodd@debian.org> - 2020-03-30 17:00 +0200

csiph-web