CVE-2019-3820

What it actually does

The gnome-shell lock screen fails to restrict contextual actions such as keyboard shortcuts, allowing invocation of actions that should be blocked when the screen is locked.

Why it matters to the business

An attacker with brief physical access can bypass the lock screen to perform limited actions on an unattended workstation, increasing risk of data exposure or unauthorized commands until the system is updated.

How an attack unfolds

An attacker with physical access to a locked workstation presses allowed keyboard shortcuts to trigger contextual actions that the lock screen should have blocked.

How to fix it

Upgrade affected packages to the listed fixed versions: chicken (Debian:11/12/13) to 4.8.0-1 and e.org/GNOME/epiphany (GIT) to 0777a3db37a3c8520740448bf50f620a94a8e551.

How to confirm the fix worked

Confirm the installed gnome-shell or related package version meets or exceeds the fixed releases and test that keyboard shortcuts no longer function on the lock screen.

Typical attack path

1. Obtain physical access to a locked workstation
2. Invoke keyboard shortcuts or other contextual actions on the lock screen
3. Execute restricted operations that bypass authentication

How to detect it

Review authentication and session logs for activity immediately after lock events or unexpected shortcut invocations; physical-access attacks leave minimal artifacts.

What your security team should do

• Apply the listed fixed package versions immediately on all affected systems
• Enforce physical security controls around workstations
• Audit for any post-lock activity in system logs