Security problem: no password required to unlock, followed by crash - on a Framework 13

[LinuxOnTheDesktop]

Distribution

Mint 22.1

Package version

6.4.8

Graphics hardware in use

AMD onboard

Frequency

Only occasionally

Bug description

Twice now my Framework 13 has come out of sleep without asking for a password. The most recent (i.e, second) time that this happened the machine showed a blank screen for some twenty seconds, then showed the lock screen with my password prompt, and then showed my desktop. Much was not working on the desktop - my conky had blank fields, and the icons in my dock (Plank) were all generic placeholders. I used the panel to try to restart Cinnamon. The result was a very hard crash.

Steps to reproduce

The problem is intermittent. When it occurs:

1. Have the PC sleep.
2. Return to PC.
3. PC wakes slowly and lets one passwordlessly onto a crashing desktop.

Expected behavior

Not 3.

Additional information

Framework 13 with BIOS 3.09. (The problem might be partly the BIOS: as it becoming notorious, Framework produces bad BIOSes.)

Kernel 6.11.0.25-generic

The System Reports program had no crash dump. I did not know what to look for in the systemlog or in dmesg.

What happened to the box that one could tick to report a security bug confidentially?

[clefebvre]

This needs troubleshooting.

Check for crashes, logs. Identify what happens exactly and which software component is buggy.

[LinuxOnTheDesktop]

Hello.

This needs troubleshooting.

Check for crashes, logs. Identify what happens exactly and which software component is buggy.

I did write: 'The System Reports program had no crash dump. I did not know what to look for in the systemlog or in dmesg.'

But I think I have found the culprit - namely, this kernel parameter, when used on a machine with an AMD processor: nvme.noacpi=1. This prominent post on the Framework forum advises that one use that switch. Responses in the same thread reveal that, on an AMD machine, one really should not.

I do not know whether the problem still counts as a security problem. I did get admitted without a password. But if one e.g. hit the computer with a hammer - i.e. did something one really shouldn't - then one might get a similar result.

I do still have an account for which I set a password and which I can log into (only) without a password.