Post Syndicated from jzb original https://lwn.net/Articles/1070434/

SUSE’s Security Team has published a detailed
blog post on their recent review of the Plasma
Login Manager version 6.6.2,
which was forked from the SDDM display
manager.

While most of the code remains the
same, the new upstream added a privileged
D-Bus helper called
plasmaloginauthhelper, which suffers from defense-in-depth
security issues.

[…] Based on the high severity of the defense-in-depth issues
shown in this report, our assessment is that there is effectively no
separation between root and the plasmalogin service user account.

At this time there is no bugfix available by upstream, but a
security fix is planned for the next Plasma release on May 12. We have
not been involved in upstream’s bugfix process so far and have no
knowledge about the approach that will be taken to address the issues
from this report.