Search for vulnerabilities
Vulnerability details: VCID-yg6r-axzc-aaar
Vulnerability ID VCID-yg6r-axzc-aaar
Aliases CVE-2017-8422
Summary KDE kdelibs before 4.14.32 and KAuth before 5.34 allow local users to gain root privileges by spoofing a callerID and leveraging a privileged helper app.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-290 Authentication Bypass by Spoofing
System Score Found at
generic_textual High http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8422.html
cvssv3 7.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-8422.json
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00373 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
epss 0.00462 https://api.first.org/data/v1/epss?cve=CVE-2017-8422
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6410
generic_textual High https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8422
cvssv2 6.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 7.2 https://nvd.nist.gov/vuln/detail/CVE-2017-8422
cvssv3 7.8 https://nvd.nist.gov/vuln/detail/CVE-2017-8422
archlinux High https://security.archlinux.org/AVG-269
generic_textual High https://ubuntu.com/security/notices/USN-3286-1
generic_textual High https://www.kde.org/info/security/advisory-20170510-1.txt
generic_textual Medium http://www.openwall.com/lists/oss-security/2017/05/10/3
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-8422.html
https://access.redhat.com/errata/RHSA-2017:1264
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-8422.json
https://api.first.org/data/v1/epss?cve=CVE-2017-8422
https://bugzilla.redhat.com/show_bug.cgi?id=1449647
https://cgit.kde.org/kauth.git/commit/?id=df875f725293af53399f5146362eb158b4f9216a
https://cgit.kde.org/kdelibs.git/commit/?id=264e97625abe2e0334f97de17f6ffb52582888ab
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6410
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8422
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://security.gentoo.org/glsa/201706-29
https://ubuntu.com/security/notices/USN-3286-1
https://www.exploit-db.com/exploits/42053/
https://www.kde.org/info/security/advisory-20170510-1.txt
http://www.debian.org/security/2017/dsa-3849
http://www.openwall.com/lists/oss-security/2017/05/10/3
http://www.securityfocus.com/bid/98412
http://www.securitytracker.com/id/1038480
ASA-201705-12 https://security.archlinux.org/ASA-201705-12
AVG-269 https://security.archlinux.org/AVG-269
cpe:2.3:a:kde:kauth:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:kde:kauth:*:*:*:*:*:*:*:*
cpe:2.3:a:kde:kdelibs:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:kde:kdelibs:*:*:*:*:*:*:*:*
CVE-2017-8422 https://nvd.nist.gov/vuln/detail/CVE-2017-8422
CVE-2017-8849;CVE-2017-8422 Exploit https://github.com/stealth/plasmapulsar/blob/921a61b16938b7d69c2abbe3848dffc8f9238168/smb0k.c
CVE-2017-8849;CVE-2017-8422 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/42053.c
USN-3286-1 https://usn.ubuntu.com/3286-1/
Data source Exploit-DB
Date added May 23, 2017
Description KDE 4/5 - 'KAuth' Local Privilege Escalation
Ransomware campaign use Unknown
Source publication date May 18, 2017
Exploit type local
Platform linux
Source update date May 23, 2017
Source URL https://github.com/stealth/plasmapulsar/blob/921a61b16938b7d69c2abbe3848dffc8f9238168/smb0k.c
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-8422.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2017-8422
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-8422
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05128
EPSS Score 0.00042
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.