PT-2017-17850 · Deepin · Dde-Daemon

Kings Way · Publicado 2017-04-10 · Atualizado 2019-10-03 · CVE-2017-7622

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dde-daemon versions 15.0 through 15.3

Description The issue concerns the dde-daemon process in the Deepin Desktop Environment, which runs with root privileges and lacks sufficient user identification when functions are called through D-Bus. This allows anyone to modify the grub configuration, potentially creating a backdoor or escalating privileges, by calling the DoWriteGrubSettings() function.

Recommendations For versions 15.0 through 15.3, consider restricting access to the DoWriteGrubSettings() function provided by dde-daemon to prevent unauthorized modifications to the grub configuration. As a temporary workaround, restrict the use of the dde-daemon's D-Bus interface to minimize the risk of exploitation.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2017-7622

Produtos afetados

Dde-Daemon

Referências · 3

• 🔥 https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7622 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7622 · Aviso do Fabricante