PT-2017-17850 · Deepin · Dde-Daemon

Kings Way · Published 2017-04-10 · Updated 2019-10-03 · CVE-2017-7622

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dde-daemon versions 15.0 through 15.3

Description The issue concerns the dde-daemon process in the Deepin Desktop Environment, which runs with root privileges and lacks sufficient user identification when functions are called through D-Bus. This allows anyone to modify the grub configuration, potentially creating a backdoor or escalating privileges, by calling the DoWriteGrubSettings() function.

Recommendations For versions 15.0 through 15.3, consider restricting access to the DoWriteGrubSettings() function provided by dde-daemon to prevent unauthorized modifications to the grub configuration. As a temporary workaround, restrict the use of the dde-daemon's D-Bus interface to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2017-7622

Affected Products

Dde-Daemon

References · 3

• 🔥 https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7622 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7622 · Vendor Advisory