How severe is CVE-2021-20315?

CVE-2021-20315 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.

Is CVE-2021-20315 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-20315?

CVE-2021-20315 primarily affects Gnome Gnome-shell. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-20315?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-20315 published?

CVE-2021-20315 was published on 2022-02-18 and last updated on 2026-06-17.

CVE-2021-20315

CVE-2021-20315 is a medium-severity vulnerability in Gnome Gnome-shell with a CVSS 3.x base score of 6.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-667.

Key facts

Severity: Medium (CVSS 3.x base score 6.1)
CVSS v2: 3.6
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-667
Affected product: Gnome Gnome-shell
Published: 2022-02-18
Last modified: 2026-06-17

Description

A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked.

Frequently asked questions

What is CVE-2021-20315?: A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked.
How severe is CVE-2021-20315?: CVE-2021-20315 has a CVSS 3.x base score of 6.1, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability high.
Is CVE-2021-20315 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-20315?: CVE-2021-20315 primarily affects Gnome Gnome-shell. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-20315?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-20315 published?: CVE-2021-20315 was published on 2022-02-18 and last updated on 2026-06-17.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2006285

Affected products (2)

cpe:2.3:a:gnome:gnome-shell:*:*:*:*:*:*:*:*
cpe:2.3:o:centos:stream:8:*:*:*:*:*:*:*

More vulnerabilities in Gnome Gnome-shell

CVE-2017-8288 — High (CVSS 8.1): gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled…
CVE-2014-7300 — High (CVSS 7.2): GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption…
CVE-2010-4000 — Medium (CVSS 6.9): gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users…
CVE-2012-4427 — Medium (CVSS 6.8): The gnome-shell plugin 3.4.1 in GNOME allows remote attackers to force the download and installation of arbitrary…
CVE-2023-43090 — Medium (CVSS 5.5): A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view…
CVE-2021-3982 — Medium (CVSS 5.5): Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker,…

All CVEs affecting Gnome Gnome-shell →

Other CWE-667 (Improper Locking) vulnerabilities

CVE-2020-12658 — Critical (CVSS 9.8): gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in…
CVE-2019-5886 — Critical (CVSS 9.8): An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation…
CVE-2026-43215 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used…
CVE-2026-31629 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED…
CVE-2020-15674 — High (CVSS 8.8): Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory…
CVE-2021-1622 — High (CVSS 8.6): A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband…

Browse all CWE-667 (Improper Locking) vulnerabilities →