CVE-2014-7300 Denial of service in n/a

What is CVE-2014-7300?

CVE-2014-7300 is a high-severity denial of service vulnerability in Redhat Enterprise Linux Desktop, published on 25 Dec 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.

Weakness: CWE-399

Which versions are affected by CVE-2014-7300?

It affects 5 products.

Products include Gnome Gnome-Shell, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.

How do I fix CVE-2014-7300?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-7300 being exploited?

There is no known exploitation of CVE-2014-7300 in the wild and no public exploit code.

Other vulnerabilities in Redhat Enterprise Linux Desktop

• CVE-2017-8288 Security feature bypass in n/a High 8.1
• CVE-2010-4000 Privilege escalation in n/a Medium 6.9
• CVE-2012-4427 Code injection in n/a Medium 6.8
• CVE-2021-3982 Privilege escalation in gnome-shell Medium 5.5
• CVE-2013-7220 Command injection in n/a Medium 4.6

All Redhat Enterprise Linux Desktop vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-7300, GHSA-gg6w-rmxx-j7xr, MGASA-2014-0501, RHSA-2015:0535, SUSE-SU-2015:0515-1, openSUSE-SU-2024:10441-1.