CVE-2017-7622

Published: Apr 10, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

dde-daemon, the daemon process of DDE (Deepin Desktop Environment) 15.0 through 15.3, runs with root privileges and hardly does anything to identify the user who calls the function through D-Bus. Anybody can change the grub config, even to append some arguments to make a backdoor or privilege escalation, by calling DoWriteGrubSettings() provided by dde-daemon.

Affected (4)

Products: Deepin: Deepin Desktop Environment

Deepin

1 product

Deepin Desktop Environment

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Deepin Deepin Desktop Environment	Version 15.0
Deepin Deepin Desktop Environment	Version 15.1
Deepin Deepin Desktop Environment	Version 15.2
Deepin Deepin Desktop Environment	Version 15.3

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.py

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/kings-way/deepinhack/blob/master/dde_daemon_poc.py

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.