CVE-2014-7272
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges...
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
- Record
CVE-2014-7272- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
- Record
CVE-2014-7272- Updated
- 2026-11-02
EUVDEUVD-2014-7143 No score
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
- Record
EUVD-2014-7143- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2qgx-m88q-gp35
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges...
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
- Record
GHSA-2qgx-m88q-gp35- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
- Record
CVE-2014-7272- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-7272
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).
- Record
DEBIAN-CVE-2014-7272- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2014-0504 No score
Updated sddm packages fix security vulnerabilities
Sddm may in some cases allow unauthenticated logins as the sddm user (CVE-2014-7271).
Sddm is vulnerable to a race condition in XAUTHORITY file generation (CVE-2014-7272).
Sddm has been updated to version 0.10.0, fixing these issues and several other bugs, and adding new functionality.
libxcb packages have been updated to work with sddm.
- Record
MGASA-2014-0504- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10135-1 No score
sddm-0.14.0-2.1 on GA media
These are all security issues fixed in the sddm-0.14.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10135-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sddmDebian:12 |
before 0.11.0-2 | 0.11.0-2 |
sddmDebian:13 |
before 0.11.0-2 | 0.11.0-2 |
sddmDebian:14 |
before 0.11.0-2 | 0.11.0-2 |
sddmMageia:4 From an advisory covering 2 CVEs |
before 0.10.0-1.mga4 | 0.10.0-1.mga4 |
libxcbMageia:4 From an advisory covering 2 CVEs |
before 1.9.1-2.1.mga4 | 1.9.1-2.1.mga4 |
sddmopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 0.14.0-2.1 | 0.14.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-7272 is a high vulnerability (CVSS 7.8) in Sddm Project Sddm, published December 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in sddm 0.11.0-2.
References
github.com/sddm/sddm/pull/280
bugzilla.redhat.com/show_bug.cgi?id=1149610
lists.fedoraproject.org/pipermail/package-announce/2014-October/141550.html
openwall.com/lists/oss-security/2014/10/06/4
nvd.nist.gov/vuln/detail/CVE-2014-7272
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2014-7272
advisories.mageia.org/MGASA-2014-0504.html
bugs.mageia.org/show_bug.cgi?id=14238
suse.com/security/cve/CVE-2014-7271