QEMU (Gentoo) - Local Privilege Escalation

QEMU Gentoo - Local Privilege Escalation / == virtfshell == Some distributions make virtfs-proxy-helper from QEMU either SUID or give it CAPCHOWN fs capabilities. This is a terrible idea. While virtfs-proxy-helper makes some sort of flimsy check to make sure its socket path doesn't already exist,...

QEMU (Gentoo) - Local Privilege Escalation

/ == virtfshell == Some distributions make virtfs-proxy-helper from QEMU either SUID or give it CAPCHOWN fs capabilities. This is a terrible idea. While virtfs-proxy-helper makes some sort of flimsy check to make sure its socket path doesn't already exist, it is vulnerable to TOCTOU. This should...