CVE-2017-7622 dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user who calls the function through D-Bus. Anyb...
HighCVSS 8.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user who calls the function through D-Bus. Anybody can change the grub config, even to append some arguments to make a backdoor or privilege escalation, by calling DoWriteGrubSettings() provided by dde-daemon.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| deepin desktop environment | = 15.0 | No fix listed |
| deepin desktop environment | = 15.1 | No fix listed |
| deepin desktop environment | = 15.2 | No fix listed |
| deepin desktop environment | = 15.3 | No fix listed |
References
- github.com exploit third-party-advisory