CVE-2013-4394: Medium severity systemd vulnerability
A possibility of unauthorized Xorg X11 Server configuration file modification / injection was found in the way SetX11Keyboard() method of systemd, a system and service manager, performed sanitization of provided X Keyboard Extension (XKB) layouts description (special and control characters were not filtered out from the layout description properly). When the host in question used PolicyKit Local Authority (PKLA) file mechanism to grant group of users the privilege to change XKB settings (instead of default PolicyKit check) and particular local attacker was member of that group, they could use this flaw to inject arbitrary values into the Xorg X11 Server configuration file, possibly leading to escalation of their privileges.
Issue found by Florian Weimer, Red Hat Product Security Team
Other sources
The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters."
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4394?
CVE-2013-4394 is considered a medium severity vulnerability due to the potential for unauthorized configuration file modification.
How do I fix CVE-2013-4394?
To fix CVE-2013-4394, upgrade systemd to version 194 or later, or apply the appropriate security patches for your system.
Which software is affected by CVE-2013-4394?
CVE-2013-4394 affects systemd versions prior to 194 and Debian GNU/Linux version 7.0.
What is the exploit vector for CVE-2013-4394?
The exploit vector for CVE-2013-4394 involves unauthorized modification or injection into the Xorg X11 Server configuration files.
What type of vulnerability is CVE-2013-4394?
CVE-2013-4394 is a configuration injection vulnerability that affects the sanitization processes in the SetX11Keyboard() method.