Unscored severity · published Dec 25, 2014
CVE-2014-7300
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically…
–
CVSS
0.5%
EPSS
No
On KEV
Description
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Hpc Node · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
GN
Gnome-shell · Gnome
3.14.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7300
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7300
Mailing List
http://openwall.com/lists/oss-security/2014/09/29/17
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0535.html
Issue Tracking
https://bugzilla.gnome.org/show_bug.cgi?id=737456
Issue Tracking
https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013
Issue Tracking
https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378
More from Gnome-shell
8.1
CVE-2017-8288
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen
6.1
CVE-2021-20315
A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are…
5.5
CVE-2023-43090
A vulnerability was found in GNOME Shell
5.5
CVE-2021-3982
Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue
4.3
CVE-2020-17489
An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4