Incorrect default permissions in QEMU - CVE-2022-0358

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU61492

Incorrect default permissions in QEMU - CVE-2022-0358

Published: March 21, 2022


Vulnerability identifier: #VU61492
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-0358
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect QEMU virtio-fs shared file system daemon (virtiofsd) implementation. An attacker on the guest OS can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This can lead to privilege escalation within the guest OS.

The vulnerability exists due to incomplete fox for #VU13631 (CVE-2018-13405).


Affected software

QEMU
Debian Linux
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
Anolis OS
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
Ubuntu
openEuler
Fedora
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
netcf-libs
netcf-devel
netcf
sgabios-bin
sgabios
qemu-ipxe
ocaml-libnbd-devel
ocaml-libnbd
python3-libnbd
nbdfuse
libnbd
libnbd-devel
libvirt-dbus
hivex-devel
perl-hivex
python3-hivex
ocaml-hivex-devel
ruby-hivex
ocaml-hivex
hivex
seabios
seavgabios-bin
seabios-bin
qemu-seabios
qemu-vgabios
nbdkit-devel
nbdkit-xz-filter
nbdkit-ssh-plugin
nbdkit-server
nbdkit-python-plugin
nbdkit-linuxdisk-plugin
nbdkit-gzip-plugin
nbdkit-example-plugins
nbdkit-curl-plugin
nbdkit-basic-plugins
nbdkit-basic-filters
nbdkit
nbdkit-bash-completion
nbdkit-vddk-plugin
libiscsi-utils
libiscsi-devel
libiscsi
libguestfs-inspect-icons
ocaml-libguestfs-devel
libguestfs-xfs
libguestfs-tools-c
libguestfs-rsync
libguestfs-rescue
libguestfs-java-devel
libguestfs-java
libguestfs-gobject-devel
libguestfs-gobject
libguestfs-gfs2
libguestfs-devel
libguestfs-benchmarking
libguestfs
libguestfs-javadoc
libguestfs-man-pages-ja
libguestfs-man-pages-uk
libguestfs-tools
virt-v2v
python3-libguestfs
ocaml-libguestfs
perl-Sys-Guestfs
ruby-libguestfs
libguestfs-bash-completion
virt-dib
lua-guestfs
qemu-kvm-tests
qemu-kvm-core
qemu-kvm-common
qemu-kvm-block-ssh
qemu-kvm-block-rbd
qemu-kvm-block-iscsi
qemu-kvm-block-curl
qemu-kvm
qemu-img
qemu-guest-agent
qemu-kvm-block-gluster
supermin-devel
supermin
qemu
qemu-arm
qemu-arm-debuginfo
qemu-ppc
qemu-ppc-debuginfo
qemu-SLOF
qemu-hw-display-virtio-gpu-pci-debuginfo
qemu-hw-display-virtio-gpu-pci
qemu-skiboot
qemu-hw-display-virtio-gpu-debuginfo
qemu-audio-alsa
qemu-audio-alsa-debuginfo
qemu-audio-pa
qemu-audio-pa-debuginfo
qemu-x86
qemu-x86-debuginfo
qemu-hw-s390x-virtio-gpu-ccw
qemu-hw-s390x-virtio-gpu-ccw-debuginfo
qemu-s390x
qemu-s390x-debuginfo
qemu-tools
qemu-tools-debuginfo
qemu-block-iscsi-debuginfo
qemu-ui-curses-debuginfo
qemu-ui-curses
qemu-lang
qemu-ksm
qemu-guest-agent-debuginfo
qemu-block-curl
qemu-block-curl-debuginfo
qemu-block-iscsi
qemu-block-rbd
qemu-block-rbd-debuginfo
qemu-block-ssh
qemu-debugsource
qemu-hw-display-virtio-gpu
qemu-block-ssh-debuginfo
qemu-debuginfo
qemu-chardev-baum-debuginfo
qemu-chardev-baum
qemu-audio-spice-debuginfo
qemu-ui-spice-core-debuginfo
qemu-ui-spice-core
qemu-ui-spice-app-debuginfo
qemu-ui-spice-app
qemu-ui-opengl-debuginfo
qemu-ui-opengl
qemu-ui-gtk-debuginfo
qemu-ui-gtk
qemu-hw-usb-redirect-debuginfo
qemu-hw-usb-redirect
qemu-hw-display-virtio-vga-debuginfo
qemu-hw-display-virtio-vga
qemu-hw-display-qxl-debuginfo
qemu-hw-display-qxl
qemu-chardev-spice-debuginfo
qemu-chardev-spice
qemu-audio-spice
python3-libvirt
perl-Sys-Virt
libvirt-daemon-driver-network
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-interface
libvirt-daemon-config-nwfilter
libvirt-daemon-config-network
libvirt-daemon
libvirt-client
libvirt-bash-completion
libvirt-daemon-driver-qemu
libvirt-admin
libvirt-daemon-driver-storage-mpath
libvirt-nss
libvirt-lock-sanlock
libvirt-libs
libvirt-docs
libvirt-devel
libvirt-daemon-kvm
libvirt-daemon-driver-storage-scsi
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-gluster
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-daemon-driver-secret
libvirt
qemu-system-aarch64
qemu-system-x86_64
qemu-system-arm
qemu-hw-usb-host
qemu-system-riscv
qemu-help
qemu-sgabios
libguestfs-winsupport
qemu-system-sparc (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-s390x (Ubuntu package)
qemu-system-x86 (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-x86-xen (Ubuntu package)
qemu-system-x86-microvm (Ubuntu package)
qemu (Debian package)
Red Hat Enterprise Linux Advanced Virtualization

How to mitigate CVE-2022-0358

Install updates from vendor's website.

netcf-libs - update to 0.2.8-12
netcf-devel - update to 0.2.8-12
netcf - update to 0.2.8-12
sgabios-bin - update to 0.20170427git-3
sgabios - update to 0.20170427git-3
qemu-ipxe - update to 1.0.0+-150300.112.4
ocaml-libnbd-devel - update to 1.2.2-1.0.1
ocaml-libnbd - update to 1.2.2-1.0.1
python3-libnbd - update to 1.2.2-1.0.1
nbdfuse - update to 1.2.2-1.0.1
libnbd - update to 1.2.2-1.0.1
libnbd-devel - update to 1.2.2-1.0.1
libvirt-dbus - update to 1.3.0-2
hivex-devel - update to 1.3.18-21
perl-hivex - update to 1.3.18-21
python3-hivex - update to 1.3.18-21
ocaml-hivex-devel - update to 1.3.18-21
ruby-hivex - update to 1.3.18-21
ocaml-hivex - update to 1.3.18-21
hivex - update to 1.3.18-21
seabios - update to 1.13.0-2
seavgabios-bin - update to 1.13.0-2
seabios-bin - update to 1.13.0-2
qemu-seabios - update to 1.14.0_0_g155821a-150300.112.4
qemu-vgabios - update to 1.14.0_0_g155821a-150300.112.4
nbdkit-devel - update to 1.16.2-4
nbdkit-xz-filter - update to 1.16.2-4
nbdkit-ssh-plugin - update to 1.16.2-4
nbdkit-server - update to 1.16.2-4
nbdkit-python-plugin - update to 1.16.2-4
nbdkit-linuxdisk-plugin - update to 1.16.2-4
nbdkit-gzip-plugin - update to 1.16.2-4
nbdkit-example-plugins - update to 1.16.2-4
nbdkit-curl-plugin - update to 1.16.2-4
nbdkit-basic-plugins - update to 1.16.2-4
nbdkit-basic-filters - update to 1.16.2-4
nbdkit - update to 1.16.2-4
nbdkit-bash-completion - update to 1.16.2-4
nbdkit-vddk-plugin - update to 1.16.2-4
libiscsi-utils - update to 1.18.0-8.0.1
libiscsi-devel - update to 1.18.0-8.0.1
libiscsi - update to 1.18.0-8.0.1
libguestfs-inspect-icons - update to 1.40.2-28.0.1
ocaml-libguestfs-devel - update to 1.40.2-28.0.1
libguestfs-xfs - update to 1.40.2-28.0.1
libguestfs-tools-c - update to 1.40.2-28.0.1
libguestfs-rsync - update to 1.40.2-28.0.1
libguestfs-rescue - update to 1.40.2-28.0.1
libguestfs-java-devel - update to 1.40.2-28.0.1
libguestfs-java - update to 1.40.2-28.0.1
libguestfs-gobject-devel - update to 1.40.2-28.0.1
libguestfs-gobject - update to 1.40.2-28.0.1
libguestfs-gfs2 - update to 1.40.2-28.0.1
libguestfs-devel - update to 1.40.2-28.0.1
libguestfs-benchmarking - update to 1.40.2-28.0.1
libguestfs - update to 1.40.2-28.0.1
libguestfs-javadoc - update to 1.40.2-28.0.1
libguestfs-man-pages-ja - update to 1.40.2-28.0.1
libguestfs-man-pages-uk - update to 1.40.2-28.0.1
libguestfs-tools - update to 1.40.2-28.0.1
virt-v2v - update to 1.40.2-28.0.1
python3-libguestfs - update to 1.40.2-28.0.1
ocaml-libguestfs - update to 1.40.2-28.0.1
perl-Sys-Guestfs - update to 1.40.2-28.0.1
ruby-libguestfs - update to 1.40.2-28.0.1
libguestfs-bash-completion - update to 1.40.2-28.0.1
virt-dib - update to 1.40.2-28.0.1
lua-guestfs - update to 1.40.2-28.0.1
qemu-kvm-tests - update to 4.2.0-59.0.2
qemu-kvm-core - update to 4.2.0-59.0.2
qemu-kvm-common - update to 4.2.0-59.0.2
qemu-kvm-block-ssh - update to 4.2.0-59.0.2
qemu-kvm-block-rbd - update to 4.2.0-59.0.2
qemu-kvm-block-iscsi - update to 4.2.0-59.0.2
qemu-kvm-block-curl - update to 4.2.0-59.0.2
qemu-kvm - update to 4.2.0-59.0.2
qemu-img - update to 4.2.0-59.0.2
qemu-guest-agent - update to 4.2.0-59.0.2
qemu-kvm-block-gluster - update to 4.2.0-59.0.2
supermin-devel - update to 5.1.19-10
supermin - update to 5.1.19-10
qemu - addressed in versions 5.2.0-9.fc34, 6.1.0-14.fc35, 6.2.0-4.fc36.1, 6.2.0-5.fc37
qemu-kvm - update to 5.2.0-150300.112.4
qemu-arm - update to 5.2.0-150300.112.4
qemu-arm-debuginfo - update to 5.2.0-150300.112.4
qemu-ppc - update to 5.2.0-150300.112.4
qemu-ppc-debuginfo - update to 5.2.0-150300.112.4
qemu-SLOF - update to 5.2.0-150300.112.4
qemu-hw-display-virtio-gpu-pci-debuginfo - update to 5.2.0-150300.112.4
qemu-hw-display-virtio-gpu-pci - update to 5.2.0-150300.112.4
qemu-skiboot - update to 5.2.0-150300.112.4
qemu-hw-display-virtio-gpu-debuginfo - update to 5.2.0-150300.112.4
qemu-audio-alsa - update to 5.2.0-150300.112.4
qemu-audio-alsa-debuginfo - update to 5.2.0-150300.112.4
qemu-audio-pa - update to 5.2.0-150300.112.4
qemu-audio-pa-debuginfo - update to 5.2.0-150300.112.4
qemu-x86 - update to 5.2.0-150300.112.4
qemu-x86-debuginfo - update to 5.2.0-150300.112.4
qemu-hw-s390x-virtio-gpu-ccw - update to 5.2.0-150300.112.4
qemu-hw-s390x-virtio-gpu-ccw-debuginfo - update to 5.2.0-150300.112.4
qemu-s390x - update to 5.2.0-150300.112.4
qemu-s390x-debuginfo - update to 5.2.0-150300.112.4
qemu-tools - update to 5.2.0-150300.112.4
qemu-tools-debuginfo - update to 5.2.0-150300.112.4
qemu-block-iscsi-debuginfo - update to 5.2.0-150300.112.4
qemu-ui-curses-debuginfo - update to 5.2.0-150300.112.4
qemu-ui-curses - update to 5.2.0-150300.112.4
qemu-lang - update to 5.2.0-150300.112.4
qemu-ksm - update to 5.2.0-150300.112.4
qemu-guest-agent-debuginfo - update to 5.2.0-150300.112.4
qemu - update to 5.2.0-150300.112.4
qemu-block-curl - update to 5.2.0-150300.112.4
qemu-block-curl-debuginfo - update to 5.2.0-150300.112.4
qemu-block-iscsi - update to 5.2.0-150300.112.4
qemu-guest-agent - update to 5.2.0-150300.112.4
qemu-block-rbd - update to 5.2.0-150300.112.4
qemu-block-rbd-debuginfo - update to 5.2.0-150300.112.4
qemu-block-ssh - update to 5.2.0-150300.112.4
qemu-debugsource - update to 5.2.0-150300.112.4
qemu-hw-display-virtio-gpu - update to 5.2.0-150300.112.4
qemu-block-ssh-debuginfo - update to 5.2.0-150300.112.4
qemu-debuginfo - update to 5.2.0-150300.112.4
qemu-chardev-baum-debuginfo - update to 5.2.0-150300.112.4
qemu-chardev-baum - update to 5.2.0-150300.112.4
qemu-audio-spice-debuginfo - update to 5.2.0-150300.112.4
qemu-ui-spice-core-debuginfo - update to 5.2.0-150300.112.4
qemu-ui-spice-core - update to 5.2.0-150300.112.4
qemu-ui-spice-app-debuginfo - update to 5.2.0-150300.112.4
qemu-ui-spice-app - update to 5.2.0-150300.112.4
qemu-ui-opengl-debuginfo - update to 5.2.0-150300.112.4
qemu-ui-opengl - update to 5.2.0-150300.112.4
qemu-ui-gtk-debuginfo - update to 5.2.0-150300.112.4
qemu-ui-gtk - update to 5.2.0-150300.112.4
qemu-hw-usb-redirect-debuginfo - update to 5.2.0-150300.112.4
qemu-hw-usb-redirect - update to 5.2.0-150300.112.4
qemu-hw-display-virtio-vga-debuginfo - update to 5.2.0-150300.112.4
qemu-hw-display-virtio-vga - update to 5.2.0-150300.112.4
qemu-hw-display-qxl-debuginfo - update to 5.2.0-150300.112.4
qemu-hw-display-qxl - update to 5.2.0-150300.112.4
qemu-chardev-spice-debuginfo - update to 5.2.0-150300.112.4
qemu-chardev-spice - update to 5.2.0-150300.112.4
qemu-audio-spice - update to 5.2.0-150300.112.4
python3-libvirt - update to 6.0.0-1
perl-Sys-Virt - update to 6.0.0-1
libvirt-daemon-driver-network - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-nodedev - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-interface - update to 6.0.0-37.1.0.1
libvirt-daemon-config-nwfilter - update to 6.0.0-37.1.0.1
libvirt-daemon-config-network - update to 6.0.0-37.1.0.1
libvirt-daemon - update to 6.0.0-37.1.0.1
libvirt-client - update to 6.0.0-37.1.0.1
libvirt-bash-completion - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-qemu - update to 6.0.0-37.1.0.1
libvirt-admin - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-mpath - update to 6.0.0-37.1.0.1
libvirt-nss - update to 6.0.0-37.1.0.1
libvirt-lock-sanlock - update to 6.0.0-37.1.0.1
libvirt-libs - update to 6.0.0-37.1.0.1
libvirt-docs - update to 6.0.0-37.1.0.1
libvirt-devel - update to 6.0.0-37.1.0.1
libvirt-daemon-kvm - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-scsi - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-rbd - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-nwfilter - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-logical - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-iscsi-direct - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-iscsi - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-gluster - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-disk - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage-core - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-storage - update to 6.0.0-37.1.0.1
libvirt-daemon-driver-secret - update to 6.0.0-37.1.0.1
libvirt - update to 6.0.0-37.1.0.1
qemu-img - update to 6.2.0-43
qemu - update to 6.2.0-43
qemu-block-iscsi - update to 6.2.0-43
qemu-block-curl - update to 6.2.0-43
qemu-block-rbd - update to 6.2.0-43
qemu-system-aarch64 - update to 6.2.0-43
qemu-system-x86_64 - update to 6.2.0-43
qemu-block-ssh - update to 6.2.0-43
qemu-debugsource - update to 6.2.0-43
qemu-system-arm - update to 6.2.0-43
qemu-guest-agent - update to 6.2.0-43
qemu-hw-usb-host - update to 6.2.0-43
qemu-system-riscv - update to 6.2.0-43
qemu-help - update to 6.2.0-43
qemu-seabios - update to 6.2.0-43
qemu-debuginfo - update to 6.2.0-43
qemu-sgabios - update to 8-150300.112.4
libguestfs-winsupport - update to 8.2-1
qemu-system-sparc (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-misc (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-s390x (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-x86 (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-ppc (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-mips (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-arm (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system (Ubuntu package) - addressed in versions 1:2.11+dfsg-1ubuntu7.39, 1:2.11+dfsg-1ubuntu7.40, 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-x86-xen (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu-system-x86-microvm (Ubuntu package) - addressed in versions 1:4.2-3ubuntu6.21, 1:4.2-3ubuntu6.23, 1:6.0+dfsg-2expubuntu1.2, 1:6.0+dfsg-2expubuntu1.3, 1:6.2+dfsg-2ubuntu6.2
qemu (Debian package) - update to 1:5.2+dfsg-11+deb11u2

External References

Related Security Bulletins