Vulnerability Details CVE-2014-7300
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.0%
CVSS Severity
CVSS v2 Score 7.2
References
- http://openwall.com/lists/oss-security/2014/09/29/17
- http://rhn.redhat.com/errata/RHSA-2015-0535.html
- https://bugzilla.gnome.org/show_bug.cgi?id=737456
- https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013
- https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378
- http://openwall.com/lists/oss-security/2014/09/29/17
- http://rhn.redhat.com/errata/RHSA-2015-0535.html
- https://bugzilla.gnome.org/show_bug.cgi?id=737456
- https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013
- https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378
Products affected by CVE-2014-7300
-
cpe:2.3:a:gnome:gnome-shell:3.14.0
-
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
-
cpe:2.3:o:redhat:enterprise_linux_hpc_node:7.0
-
cpe:2.3:o:redhat:enterprise_linux_server:7.0
-
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0