Mashing keys disables a screen lock
Summary
An unusual Cinnamon screensaver bug shows how masses of input can crash a security-critical desktop component and expose the session. Linux Mint then released fixed packages. Security interfaces must fail closed rather than open when errors occur.
Ideas
- A very large number of keystrokes stressed an unexpected processing path.
- The crash ended the lock screen instead of keeping the session secure.
- Children discovered the bug by randomly pressing keys.
- The public report made fast reproduction and correction possible.
Insights
- Unusual amounts of input belong in robustness and fuzz tests.
- Random user behaviour reaches states that normal test cases miss.
Facts
- The bug affected cinnamon-screensaver.
Recommendations
- Treat a lock screen crash as a security event.
- Automatically test long, parallel and invalid input sequences.
References
Links to the original source and the Web Archive open in a new tab.