QEMU 9pfs: 9p Passthrough FS Special File Escape
CVE-2023-2861 Published on December 6, 2023
Qemu: 9pfs: improper access control on special files
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
Vulnerability Analysis
CVE-2023-2861 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2023-2861. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 22 days later.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2023-2861 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2023-2861
stack.watch emails you whenever new vulnerabilities are published in QEMU or Canonical Ubuntu Linux. Just hit a watch button to start following.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.