CVE-2023-0664: High severity qemu vulnerability
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.
Other sources
A privilege escalation vulnerability was found in the QEMU Guest Agent service for Windows. A local unprivileged user is able to manipulate the QEMU Guest Agent's Windows installer (via repair custom actions) to elevate their privileges to the SYSTEM account within the guest.
Note: this is not a VM escape flaw, meaning that it does not allow a malicious user to break out of the guest. It affects Windows VMs using virtio-win drivers with QEMU Guest Agent installed in the guest.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-0664?
CVE-2023-0664 refers to a vulnerability found in the QEMU Guest Agent service for Windows that allows a local unprivileged user to elevate their privileges on the system.
How does CVE-2023-0664 affect QEMU?
CVE-2023-0664 affects QEMU because it allows a local unprivileged user to manipulate the QEMU Guest Agent's Windows installer via repair custom actions.
What is the severity of CVE-2023-0664?
CVE-2023-0664 has a severity rating of 7.8 (high).
Which software versions are affected by CVE-2023-0664?
The QEMU versions up to and excluding 8.0.0 are affected by CVE-2023-0664.
How can I mitigate the vulnerability CVE-2023-0664?
To mitigate CVE-2023-0664, ensure that you are using QEMU version 8.0.0 or higher.