Security restrictions bypass in QEMU - CVE-2020-35517

Vulnerability identifier: #VU50041

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-35517

CWE-ID: CWE-264

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists within the virtio-fs shared file system daemon (virtiofsd). A remote privileged user of the guest operating system can create device special file in the shared directory and use it to r/w access host devices.

QEMU
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux Advanced Virtualization

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• http://seclists.org/oss-sec/2021/q1/64
• https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg05461.html

• Privilege escalation in QEMU
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
• Advanced Virtualization for RHEL 8 update for the virt:8.2 and virt-devel:8.2 modules