VulnerabilityModified

CVE-2014-7300

HIGH 7.2EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.

CVSS 2.0: 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
EPSS: 0.47% probability · 40th percentile
CISA KEV: Not listed
Weakness: CWE-399
Affected: gnome/gnome-shell · redhat/enterprise linux desktop · redhat/enterprise linux hpc node · redhat/enterprise linux server · redhat/enterprise linux workstation
Source: cve@mitre.org

References

http://openwall.com/lists/oss-security/2014/09/29/17Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0535.htmlThird Party Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=737456Issue Tracking, Vendor Advisory
https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013Issue Tracking, Patch
https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378Issue Tracking, Patch
http://openwall.com/lists/oss-security/2014/09/29/17Mailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0535.htmlThird Party Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=737456Issue Tracking, Vendor Advisory
https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013Issue Tracking, Patch
https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378Issue Tracking, Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.