Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #66626 > unrolled thread

Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information Vincent Lefevre <vincent@vinc17.net> - 2020-03-29 21:50 +0200
    Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information Vincent Lefevre <vincent@vinc17.net> - 2020-03-30 13:10 +0200
      Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information Ivo De Decker <ivodd@debian.org> - 2020-03-30 17:00 +0200

#66626 — Bug#930527: linux-image-4.19.0-5-amd64: when logging out, not the whole screen is erased, leaving private information

On 2020-03-29 19:10:30 +0200, Ivo De Decker wrote:
> On Fri, Jun 14, 2019 at 04:31:16PM +0200, Vincent Lefevre wrote:
> > When logging out, a part of the previous session is still visible.
> > This might be used to compromise the user's account or leak other
> > private information, depending on what was written on the screen.
> 
> What do you mean exactly? Is the screen only erased partially, or not at all?

It was partially erased.

> Is there something specific about your setup that you think might be relevant
> here?

I don't think so, except the use of the nouveau driver, of course.
But there were no issues for years. I think that problems started
to occur after some kernel upgrade. Now, I haven't had any problem
since December, I think.

> Also, I don't think this bug is really 'grave'. Even if private information
> remains on the screen, the user can see that, and take action to avoid it.

Not if one logs out remotely.

Regards,

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[toc] | [next] | [standalone]

#66652

Hi,

On 2020-03-30 09:06:15 +0200, Ivo De Decker wrote:
> On Sun, Mar 29, 2020 at 09:43:42PM +0200, Vincent Lefevre wrote:
> > I don't think so, except the use of the nouveau driver, of course.
> > But there were no issues for years. I think that problems started
> > to occur after some kernel upgrade. Now, I haven't had any problem
> > since December, I think.
> 
> Do you think the problem is gone with the kernel you are running now?

I don't know. I don't use this machine often, except remotely
(via ssh). But problems with the nouveau driver were common
(and a crash could occur in the nouveau driver even when using
the machine remotely only), and I haven't seen any issue recently,
even the last few times I logged in physically.

> What version is that?

linux-image-5.4.0-4-amd64 5.4.19-1

ypig:~> uname -a
Linux ypig 5.4.0-4-amd64 #1 SMP Debian 5.4.19-1 (2020-02-13) x86_64 GNU/Linux

> > > Also, I don't think this bug is really 'grave'. Even if private
> > > information remains on the screen, the user can see that, and
> > > take action to avoid it.
> > 
> > Not if one logs out remotely.
> 
> What do you mean by that?

I sometimes log in physically, but go away without logging out first
(there are sometimes a good reason, e.g. if some computation program
hasn't finished yet and I had not started it in "screen"). I can
later log in via ssh and kill the X session.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[toc] | [prev] | [next] | [standalone]

#66658

Control: severity -1 important
Control: fixed -1 5.4.19-1
Control: retitle -1 linux-image-4.19.0-5-amd64: nouveau driver sometimes crashes

Hi,

Thanks for the clarification.

On Mon, Mar 30, 2020 at 01:05:20PM +0200, Vincent Lefevre wrote:
> On 2020-03-30 09:06:15 +0200, Ivo De Decker wrote:
> > On Sun, Mar 29, 2020 at 09:43:42PM +0200, Vincent Lefevre wrote:
> > > I don't think so, except the use of the nouveau driver, of course.
> > > But there were no issues for years. I think that problems started
> > > to occur after some kernel upgrade. Now, I haven't had any problem
> > > since December, I think.
> > 
> > Do you think the problem is gone with the kernel you are running now?
> 
> I don't know. I don't use this machine often, except remotely
> (via ssh). But problems with the nouveau driver were common
> (and a crash could occur in the nouveau driver even when using
> the machine remotely only), and I haven't seen any issue recently,
> even the last few times I logged in physically.

It seems the main issue you were seeing was (is?) that the nouveau driver
wasn't always very stable. I suspect this wasn't limited to logout only.

> > What version is that?
> 
> linux-image-5.4.0-4-amd64 5.4.19-1
> 
> ypig:~> uname -a
> Linux ypig 5.4.0-4-amd64 #1 SMP Debian 5.4.19-1 (2020-02-13) x86_64 GNU/Linux

Ok, let's assume the issue is no longer present there.

> > > > Also, I don't think this bug is really 'grave'. Even if private
> > > > information remains on the screen, the user can see that, and
> > > > take action to avoid it.
> > > 
> > > Not if one logs out remotely.
> > 
> > What do you mean by that?
> 
> I sometimes log in physically, but go away without logging out first
> (there are sometimes a good reason, e.g. if some computation program
> hasn't finished yet and I had not started it in "screen"). I can
> later log in via ssh and kill the X session.

Oh. I assumed you were talking about a text console, but it seems you're
talking about a graphical login.

In any case, I don't think this qualifies as a grave bug, so I'm downgrading
it.

Cheers,

Ivo

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web