CVE-2017-7358

What it actually does

A directory traversal vulnerability in debian/guest-account.sh permits local attackers to control arbitrary directory paths, causing the script to change ownership of those paths and enabling root privilege escalation when a guest session ends.

Why it matters to the business

Local attackers can obtain full root access on affected systems, leading to complete machine compromise, data theft, or persistence; the issue has been public for years with known exploits available.

How an attack unfolds

An attacker with local access creates or triggers a guest session, supplies a crafted path containing traversal sequences to the vulnerable script, and upon logout the script performs chown operations on attacker-chosen directories, allowing the attacker to write to or execute from privileged locations.

How to fix it

Upgrade LightDM beyond version 1.22.0 to a patched release; audit and harden path handling in any guest account scripts; consider disabling guest accounts if unused.

How to confirm the fix worked

Confirm LightDM version exceeds 1.22.0, review guest-account.sh for sanitized path usage, and test that guest logout no longer permits ownership changes outside intended directories.

Typical attack path

1. Obtain local non-root access on the target system
2. Initiate a guest session or invoke the guest-account script
3. Supply malicious directory path using traversal sequences
4. Trigger logout to execute ownership change on target paths
5. Access or modify now-owned sensitive files to escalate to root

How to detect it

Inspect authentication and session logs for guest account activity, correlate with file system audit logs showing unexpected chown operations on system directories during logout events.

What your security team should do

• Apply patched LightDM packages immediately given public exploit availability
• Disable guest accounts unless explicitly required
• Monitor systems for unexpected directory ownership changes tied to guest sessions
• Review local access controls and logging around session management