CVE-2017-7622 — HIGH (8.8) — White Hats Nepal

Vulnerability Description

dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user who calls the function through D-Bus. Anybody can change the grub config, even to append some arguments to make a backdoor or privilege escalation, by calling DoWriteGrubSettings() provided by dde-daemon.

CVSS Score

8.8

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Deepin	Deepin Desktop Environment	15.0

Related Weaknesses (CWE)

CWE-862

References

https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.pyExploitThird Party Advisory
https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.pyExploitThird Party Advisory

FAQ

What is CVE-2017-7622?

CVE-2017-7622 is a vulnerability with a CVSS score of 8.8 (HIGH). dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user who calls the function through D-Bus. Anyb...

How severe is CVE-2017-7622?

CVE-2017-7622 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-7622?

Check the references section above for vendor advisories and patch information. Affected products include: Deepin Deepin Desktop Environment.