Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation

published 2025-07-23 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2016-10789

cvss: 8.5; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 1; Metasploit

A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.). In versions 0.9.53-1 (Deepin 15.5) and 0.9.66-1 (Deepin 15.7), the D-Bus configuration permits any user in the sudo group to invoke the InstallPackage method without password authentication. By default, the first user created on Deepin is in the sudo group. An attacker with shell access can craft a .deb package containing a malicious post-install script and use dbus-send to install it via lastore-daemon, resulting in arbitrary code execution as root.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-15045 updated 2026-02-06 cvss 7.0

deepin-daemon: lastore-daemon privilege escalation

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2016-02-02 First public exploit (Metasploit exploit/linux/local/lastore_daemon_dbus_priv_esc)
2025-07-23 Published

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: total
Assessed: 15 mo ago (2025-07-23)

Exploit prediction

0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/local/lastore_daemon_dbus_priv_esc lastore-daemon D-Bus Privilege Escalation metasploit exploit, excellent rank, 2016-02-02
exploit-db.com https://www.exploit-db.com/exploits/39433 referenced PoC, tagged "exploit" by a source, unverified
raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/lastore_daemon_dbus_priv_esc.rb referenced PoC, tagged "exploit" by a source, unverified
exploit-db.com https://www.exploit-db.com/exploits/44523 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Wuhan Deepin Technology Co., Ltd. Deepin Linux

Classification

Weakness

CWE-306 Missing Authentication for Critical Functionality
CWE-269 Improper Privilege Management

References

exploit-db.com /exploits/39433
exploit
raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/linux/local/lastore_daemon_dbus_priv_esc.rb
exploit
exploit-db.com /exploits/44523
exploit
github.com /linuxdeepin/lastore-daemon
product
deepin.org /en/mirrors/releases/
product
vulncheck.com /advisories/deepin-lastore-daemon-priv-esc
third-party-advisory

Sources

CVE List CVE-2016-15045
NVD CVE-2016-15045

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary