CVE-2020-28049: 
NixOS vulnerability analysis and mitigation

A race condition vulnerability (CVE-2020-28049) was discovered in SDDM (Simple Desktop Display Manager) versions before 0.19.0. The issue occurs when SDDM starts the X server using specific command line arguments (-auth and -displayfd), creating a time window where local unprivileged users could establish unauthorized connections to the X server without proper authentication (OPENWALL, NVD).

The vulnerability stems from SDDM's X server initialization process where it waits for the display number from the Xserver via 'displayfd' before writing the Xauthority file specified by the '-auth' parameter. This creates a race condition during which no valid Xauthority file exists while the Xserver is running. The X.Org server, when encountering a non-existing, empty, or incomplete Xauthority file, grants access to any connecting client. The issue has been present since SDDM version 0.12.0 and was fixed in version 0.19.0 (OPENWALL).

A local unprivileged attacker can exploit this vulnerability to create unauthorized connections to the X server and potentially intercept keyboard input events, access clipboard contents, and monitor display contents from other legitimate users accessing the X server. This represents a significant information leak and integrity violation (OPENWALL, GENTOO).

The vulnerability is locally exploitable and requires an attacker to have local user access to the system. A simple proof-of-concept exploit involves monitoring the X11 socket creation and attempting to establish connections during the vulnerable window (OPENWALL).

The vulnerability was fixed in SDDM version 0.19.0. Users and system administrators are strongly advised to upgrade to this version or later. Various distributions have released security updates to address this vulnerability, including Debian (DSA-4783-1), Fedora, and openSUSE (DEBIAN, FEDORA).