CVE-2023-2861: Qemu: 9pfs: improper access control on special files
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
Other sources
The 9p protocol does not specifically define how server shall behave when client tries to open a special file, however from security POV it does make sense for 9p server to prohibit opening any special file on host side in general. A sane Linux 9p client for instance would never attempt to open a special file on host side, it would always handle those exclusively on its guest side. A malicious client however could potentially escape from the exported 9p tree by creating and opening a device file on host side.
https://gitlab.com/qemu-project/qemu/-/commit/f6b0de53fb87ddefed348a39284c8e2f28dc4eda
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2861?
CVE-2023-2861 has a high severity rating due to the potential for unauthorized file access and system escape.
How do I fix CVE-2023-2861?
To fix CVE-2023-2861, update QEMU to the latest version specified in the mitigation guidelines for your operating system.
What systems are affected by CVE-2023-2861?
CVE-2023-2861 affects multiple versions of QEMU running on Red Hat and Ubuntu systems.
Can CVE-2023-2861 be exploited remotely?
Yes, CVE-2023-2861 can be exploited by a malicious client connecting to the 9p passthrough filesystem.
What kind of vulnerability is CVE-2023-2861?
CVE-2023-2861 is a filesystem vulnerability allowing potential escape from a restricted environment.