CVE-2014-7300 GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to exe...
HighCVSS 7.2
EPSS 0.47%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/gnome-shell(Debian:12) | < 3.14.1-1 | 3.14.1-1 |
| debian/gnome-shell(Debian:13) | < 3.14.1-1 | 3.14.1-1 |
| debian/gnome-shell(Debian:14) | < 3.14.1-1 | 3.14.1-1 |
| gnome-shell | = 3.14.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux hpc node | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-7300 vendor-advisory
- [oss-security] 20140929 gnome-shell lockscreen bypass with printscreen key mailing-list third-party-advisory
- RHSA-2015:0535 third-party-advisory vendor-advisory
- bugzilla.gnome.org issue-tracking vendor-advisory
- git.gnome.org issue-tracking patch
- git.gnome.org issue-tracking patch