CVE-2015-1319

What it actually does

The Unity Settings Daemon fails to check screen lock state before permitting automatic mounting of removable media, allowing local physical insertion of devices such as USB drives to succeed despite an active lock screen.

Why it matters to the business

Organizations using affected Ubuntu systems face risk of unauthorized data access or exfiltration by anyone with brief physical proximity to a locked workstation, potentially leading to data leakage without remote attack surface.

How an attack unfolds

An attacker with physical access to a locked Ubuntu workstation inserts a USB storage device; because the daemon does not validate the lock state, the media is mounted automatically, granting the attacker read/write access to its contents.

How to fix it

Upgrade the unity-settings-daemon package to a version containing the lock-state detection fix (for example 14.04.0+14.04.20150825-0ubuntu2 or 15.04.1+15.04.20150408-0ubuntu1.2 or later) via the distribution package manager and reboot or restart the daemon.

How to confirm the fix worked

Confirm the installed package version meets or exceeds the fixed releases listed above; test by locking the screen and inserting removable media to verify mounting is now blocked.

Typical attack path

1. Obtain brief physical access to a locked workstation
2. Insert removable media such as a USB thumb drive
3. Observe automatic mounting due to missing lock-state check
4. Access or copy files from the mounted volume

How to detect it

Review system logs for unexpected mount events (e.g., /var/log/syslog or journalctl entries referencing removable media) occurring while the session is locked; correlate timestamps with physical access logs or badge records.

What your security team should do

• Apply the package updates immediately on all affected Ubuntu systems
• Disable automatic mounting of removable media in desktop environments where feasible
• Enforce full-disk encryption and strong physical access controls as compensating measures