CVE-2021-20263: Low severity qemu vulnerability
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
Other sources
The new '-o xattrmap' option in virtiofsd causes some cases in which the 'security.capability' xattr in the guest isn't dropped on write, potentially leading to a modified privileged executable. For the problem to happen virtiofsd needs to be running with '-o xattr' and '-o xattrmap' (to enable and rename xattrs, respectively). The problem only occurs if 'security.capability' is one of the xattrs that is being renamed. Different caching modes cause different guest behavior: '-o cache=none' makes the issue easy to reproduce but it may also occur with '-o cache=auto' as well.
Virtiofsd 'xattrmap' feature in QEMU 5.2: https://gitlab.com/virtio-fs/qemu/-/commit/6084633dff3a05d6317
Upstream fix: https://git.qemu.org/?p=qemu.git;a=commit;h=e586edcb410543768ef009eaa22a2d9dd4a53846
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-20263?
CVE-2021-20263 is a vulnerability found in the virtio-fs shared file system daemon (virtiofsd) of QEMU.
What is the impact of CVE-2021-20263?
The vulnerability may allow an attacker to create a modified, privileged executable in the guest system.
How can I fix CVE-2021-20263?
Update the QEMU package to version 5.2.50 or apply the provided remedy.
What is the severity level of CVE-2021-20263?
The severity level of CVE-2021-20263 is low, with a CVSS score of 3.3.
What is the Common Weakness Enumeration (CWE) of CVE-2021-20263?
The CWE of CVE-2021-20263 is CWE-281.