{"id":183295,"date":"2026-09-08T22:53:24","date_gmt":"2026-09-08T20:53:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-os-qubes-pozvolyayushhaya-obojti-izolyacziyu-i-vypolnit-kod-na-urovne-dom0"},"modified":"2026-09-08T22:53:29","modified_gmt":"2026-09-08T20:53:29","slug":"qubes-os-vulnerability-allows-isolation-bypass-and-code-execution-in-dom0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/qubes-os-vulnerability-allows-isolation-bypass-and-code-execution-in-dom0","title":{"rendered":"A vulnerability in the Qubes OS allows bypassing isolation and executing code at the Dom0 level.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Information has been released about a vulnerability in the Qubes operating system, which uses a hypervisor for strict isolation of applications and OS components (each class of applications and system services operates in separate virtual machines). If an attacker compromises one of the virtual machines, this vulnerability allows bypassing the isolation, executing arbitrary commands on the host environment (Dom0), and gaining control over the entire operating system. The issue occurs when a user employs the utility «qvm-copy-to-vm» to copy a file from the host environment to a virtual machine controlled by the attacker. The vulnerability has been fixed in the qubes-core-dom0-linux package update 4.3.22. <\/p>\n
The problem exists in the utility «qvm-copy-to-vm» and is caused by improper error handling when accessing the virtual machine. The essence of the vulnerability is that the qvm-copy-to-vm utility, to display error information, would launch programs kdialog or zenity, using the function system() and injecting details about the failed file copy into the command line options. The cleaning of the file name was limited to removing non-ASCII characters and double quotes without checking for the presence of special characters interpreted by the command shell, such as «`» and «$». <\/p>\n
After file copying from the host system is complete, the handler on the virtual machine side returns a confirmation of the operation, which includes, among other things, the name of the last received file. The attack consists of returning an error code instead of confirmation, along with specifying a name for the file that could not be copied, which includes special characters that are processed by the command interpreter. After receiving the error, the handler on the host environment will use the system() command to launch a utility that shows a dialog with the error text, passing the returned filename (for example, specifying «file`id`» on the host environment will execute the command id). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"