CVE-2023-2861 Qemu: 9pfs: improper access control on special files

2023-12-0606:19:40

CWE-284

fedora

github.com

qemu

9pfs

access control

special files

security issue

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

AI Score

6.5

Confidence

Low

EPSS

Percentile

15.5%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*"
    ],
    "vendor": "qemu",
    "product": "qemu",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "8.1.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]