CVE-2018-20681

Vulnerability

In mate‑screensaver versions before 1.20.2, the screen lock can be bypassed by physically disconnecting and reconnecting external display outputs (HDMI, VGA, DVI, etc.) or by power‑cycling the monitor [1][2][3]. The vulnerability stems from the way mate‑screensaver handles the monitor‑changed signal on GdkScreen; when a display is removed and re‑added, the screensaver fails to re‑lock the session, leaving the desktop content visible and interactive [1]. The issue affects all MATE Desktop Environment users running mate‑screensaver 1.20.1 and earlier [2].

Exploitation

An attacker with physical access to the locked machine can perform the following steps: unplug the external display cable (e.g., HDMI) and plug it back in, or turn the monitor off and on again [2][3]. No authentication is required. In some cases, the attacker can also click with a mouse to interact with windows or launch new applications [3]. The lock bypass occurs because the screensaver does not properly re‑apply the lock when a monitor is added or removed [1][2].

Impact

A successful exploit allows the attacker to view the locked session’s screen content, potentially accessing sensitive information displayed on the desktop [2][3]. Moreover, the attacker may be able to interact with running applications (e.g., clicking buttons, typing into fields) or launch new ones with the same privileges as the logged‑in user, effectively compromising the session’s confidentiality and integrity [3].

Mitigation

The fix was applied in mate‑screensaver version 1.20.2, released on 2018‑08‑24 [1]. Instead of listening to monitor‑changed on GdkScreen, the fixed code listens to monitor‑added and monitor‑removed signals on GdkDisplay, making the lock reliable across dynamic monitor changes [1]. Users should upgrade to mate‑screensaver 1.20.2 or later. No workaround is available for unpatched versions; users must apply the update or avoid leaving unlocked sessions unattended with external display connections [2].