Arbitrary Command Execution in GNOME Shell
Summary
CVE-2014-7300: GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary comma... Affects gnome-shell versions < 3.14.1-1. Fixed in 3.14.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNOME Shell is a graphical shell for the GNOME desktop environment. It provides the core user interface and window management functionality. The Screen Lock feature in GNOME Shell allows users to lock their workstation when they are away. However, versions 3.14.x before 3.14.1 of GNOME Shell have a vulnerability that allows physically proximate attackers to execute arbitrary commands on an unattended workstation.
Vulnerability Detail
The vulnerability arises from the lack of limitation on the aggregate memory consumption of all active PrtSc (Print Screen) requests. An attacker can exploit this by making multiple PrtSc requests, causing a temporary lock outage and a resulting temporary shell availability. This outage can be leveraged to execute arbitrary commands on the workstation. The vulnerability is triggered by the Linux kernel's Out-of-Memory (OOM) killer.
How To Fix
Minimum fixed version
3.14.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade gnome-shellTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in GNOME Shell allows physically proximate attackers to execute arbitrary commands on an unattended workstation. It is recommended to update to the latest version of GNOME Shell to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gnome-shell →
FAQ
GNOME Shell is a graphical shell for the GNOME desktop environment, providing the core user interface and window management functionality.
The Screen Lock feature allows users to lock their workstation when they are away, preventing unauthorized access.
The vulnerability occurs due to the lack of limitation on the memory consumption of PrtSc requests, which can be exploited to execute arbitrary commands on an unattended workstation.
Physically proximate attackers can execute arbitrary commands on an unattended workstation, potentially compromising sensitive data or performing unauthorized actions.
To fix this vulnerability, update GNOME Shell to version 3.14.1-1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for gnome-shell.
