CVE-2017-8288

What it actually does

Lack of exception handling in js/ui/extensionSystem.js allows extensions that fail to reload to remain enabled on the lock screen, permitting bystanders to launch applications, view extension data, or execute arbitrary commands based on enabled extensions.

Why it matters to the business

Organizations using affected gnome-shell versions face risk of information disclosure or unauthorized actions on locked systems in shared or physical-access environments, though the issue is old with low exploit probability and no known ransomware use.

How an attack unfolds

An attacker with physical proximity to a locked session exploits extensions that fail to reload due to missing exception handling, allowing limited interaction such as launching apps or running commands without needing network access or credentials.

How to fix it

Upgrade gnome-shell to the fixed commit ff425d1db7082e2755d2a405af53861552acf2a1 or later versions that properly handle reload exceptions in extensionSystem.js.

How to confirm the fix worked

Verify gnome-shell commit or package version includes ff425d1db7082e2755d2a405af53861552acf2a1; test extension reload failure scenarios to confirm lock screen isolation.

Typical attack path

1. Gain physical access or proximity to a locked gnome-shell session
2. Identify or trigger extensions that fail to reload properly
3. Leverage enabled extensions on the lock screen to launch applications, observe data, or execute commands

How to detect it

Review system logs for extension reload errors in js/ui/extensionSystem.js and inspect for unexpected processes or application launches originating from lock screen contexts.

What your security team should do

• Apply the fixed gnome-shell commit across all affected systems
• Audit and minimize enabled extensions to reduce attack surface
• Monitor upstream releases for any related desktop environment updates