CVE-2021-20181: QEMU Plan 9 File System Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability
A flaw was found in QEMU in the way it handles a list of open file descriptors. Improper synchronization of this list can lead to a use-after-free.
Reference: https://bugs.launchpad.net/qemu/+bug/1911666
Upstream patch: https://git.qemu.org/?p=qemu.git;a=commit;h=89fbea8737e8f7b954745a1ffc4238d377055305
Other sources
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a malicious 9p client to cause a use-after-free error, potentially escalating their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity as well as system availability.
— Launchpad
This vulnerability allows local attackers to execute arbitrary code on affected installations of QEMU. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the handling of file descriptor maps. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor.
— ZDI
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20181?
CVE-2021-20181 is a vulnerability in QEMU that allows local attackers to execute arbitrary code on affected installations.
How severe is CVE-2021-20181?
CVE-2021-20181 has a severity rating of 7.5 (High).
Which software is affected by CVE-2021-20181?
QEMU versions up to and including 5.2.0 are affected. Additionally, Debian Linux versions 9.0 and 10.0 are affected as well.
How can an attacker exploit CVE-2021-20181?
To exploit CVE-2021-20181, an attacker must first obtain the ability to execute high-privileged code on the target guest system.
Are there any known fixes for CVE-2021-20181?
Yes, fixes for CVE-2021-20181 are available. Please refer to the relevant vendor or distribution for the specific fixes.