CVE-2013-6774: Critical severity Chainfire Supersu Android vulnerability
Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for a /system/xbin/su process. NOTE: another researcher was unable to reproduce this with ChainsDD Superuser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6774?
CVE-2013-6774 is classified as a moderate severity vulnerability due to its potential for exploitation via untrusted search paths.
How do I fix CVE-2013-6774?
To fix CVE-2013-6774, update the affected ChainsDD Superuser package to version 3.1.4 or later and ensure that all Android applications are from trusted sources.
What versions of software are affected by CVE-2013-6774?
CVE-2013-6774 affects ChainsDD Superuser package version 3.1.3, Koushik Dutta Superuser version 1.0.2.1, and Chainfire SuperSU versions before 1.69 for Android 4.2.x and earlier.
Can CVE-2013-6774 be exploited remotely?
No, CVE-2013-6774 typically requires local access to the device to exploit the untrusted search path vulnerability.
What are the potential impacts of CVE-2013-6774?
The potential impacts of CVE-2013-6774 include unauthorized code execution and privilege escalation on the affected Android devices.