Screen Locker Bypass Vulnerability in Open Whisper System's Signal App for iOS
CVE-2018-9840

6.8MEDIUM

Key Information:

Vendor

Signal

Status
Signal
Vendor
CVE Published:
10 April 2018

What is CVE-2018-9840?

The Signal app for iOS prior to version 2.23.2 exhibits a vulnerability that allows an attacker in close physical proximity to exploit the screen locker feature. By executing a rapid sequence of actions that involves opening the app, cancelling the screen, and utilizing the home button, an unauthorized user can bypass the security layer, potentially gaining access to sensitive information within the application.

References

https://github.com/signalapp/Signal-iOS/commit/018a35df7b...
x_refsource_MISC
https://github.com/signalapp/Signal-iOS/commits/release/2...
x_refsource_MISC
http://nint.en.do/Signal-Bypass-Screen-locker.php
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.