{"id":183295,"date":"2026-09-08T22:53:24","date_gmt":"2026-09-08T20:53:24","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/uyazvimost-v-os-qubes-pozvolyayushhaya-obojti-izolyacziyu-i-vypolnit-kod-na-urovne-dom0"},"modified":"2026-09-08T22:53:29","modified_gmt":"2026-09-08T20:53:29","slug":"qubes-os-vulnerability-allows-isolation-bypass-and-code-execution-in-dom0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/qubes-os-vulnerability-allows-isolation-bypass-and-code-execution-in-dom0","title":{"rendered":"Vulnerabilitet n\u00eb OS Qubes q\u00eb lejon kalimin e izolimit dhe ekzekutimin e kodit n\u00eb nivelin Dom0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Informacioni mbi nj\u00eb cenueshm\u00ebri n\u00eb sistemin operativ Qubes \u00ebsht\u00eb publikuar, i cili p\u00ebrdor nj\u00eb hipervizor p\u00ebr izolimin e rrept\u00eb t\u00eb aplikacioneve dhe komponenteve t\u00eb OS-s\u00eb (secila klas\u00eb aplikacionesh dhe sh\u00ebrbimet sistemore funksionojn\u00eb n\u00eb makinat virtuale t\u00eb ndara). N\u00eb rast se nj\u00eb sulmues komprimet nj\u00eb nga makinat virtuale, cenueshm\u00ebria lejon kalimin e izolimit, arritjen e ekzekutimit t\u00eb komandave arbitrare n\u00eb an\u00ebn e mjedisit host (Dom0) dhe marrjen e kontrollit mbi t\u00ebr\u00eb sistemin operativ. Problemi shfaqet kur p\u00ebrdoruesi p\u00ebrdor utilitarin «qvm-copy-to-vm» p\u00ebr t\u00eb kopjuar nj\u00eb skedar nga mjedisi host n\u00eb makin\u00ebn virtuale t\u00eb kontrolluar nga sulmuesi. Cenueshm\u00ebria \u00ebsht\u00eb rregulluar n\u00eb p\u00ebrdit\u00ebsimin e paket\u00ebs qubes-core-dom0-linux 4.3.22. <\/p>\n

Problemi \u00ebsht\u00eb prezent n\u00eb utilitarin «qvm-copy-to-vm» dhe shkaktohet nga trajtimi i pap\u00ebrshtatsh\u00ebm i gabimeve q\u00eb kthehen kur i drejtohet makin\u00ebs virtuale. Esenca e cenueshm\u00ebris\u00eb \u00ebsht\u00eb se utilitari qvm-copy-to-vm p\u00ebr t\u00eb shfaqur informacionin mbi gabimin kishte aktivizuar programet kdialog ose zenity, duke p\u00ebrdorur funksionin system() dhe duke futur informacionin mbi skedarin e kopjimit t\u00eb d\u00ebshtuar si opsione n\u00eb komand\u00ebn. N\u00eb k\u00ebt\u00eb rast, pastrimi i emrit t\u00eb skedarit ishte i kufizuar vet\u00ebm n\u00eb heqjen e simboleve jo-ASCII dhe thonj\u00ebzave t\u00eb dyfishta pa verifikuar pranin\u00eb e simboleve speciale q\u00eb interpretohen nga shell, si «`» dhe «$». <\/p>\n

Pas p\u00ebrfundimit t\u00eb kopjimit t\u00eb skedar\u00ebve nga sistemi host, menaxheri n\u00eb an\u00ebn e makin\u00ebs virtuale d\u00ebrgon nj\u00eb konfirmim t\u00eb operacionit, n\u00eb t\u00eb cilin, mes t\u00eb tjerash, tregohet emri i skedarit t\u00eb fundit t\u00eb pranuar. Sulmi p\u00ebrfshin kthimin e nj\u00eb kodi gabimi n\u00eb vend t\u00eb konfirmimit dhe p\u00ebrcaktimin p\u00ebr skedarin q\u00eb nuk arriti t\u00eb kopjohet, emrin me simbole speciale q\u00eb interpretohen nga shell. Pas marrjes s\u00eb gabimit, menaxheri n\u00eb an\u00ebn e mjedisit host do t\u00eb aktivizoj\u00eb me komand\u00ebn system() utilitarin p\u00ebr t\u00eb shfaqur nj\u00eb dialog me tekstin e gabimit, duke kaluar n\u00eb komand\u00eb emrin e skedarit t\u00eb kthyer nga sulmuesi (p\u00ebr shembull, kur emri «file`id`» \u00ebsht\u00eb specifikuar, n\u00eb an\u00ebn e mjedisit host do t\u00eb ekzekutohet komanda id).
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Qubes, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0439 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u0434\u043b\u044f \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041e\u0421 (\u043a\u0430\u0436\u0434\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445). \u0412 \u0441\u043b\u0443\u0447\u0430\u0435 \u0435\u0441\u043b\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u0443\u0435\u0442 \u043e\u0434\u043d\u0443 \u0438\u0437 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e, \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u0430\u043d\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0445\u043e\u0441\u0442\u043e\u0432\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f (Dom0) \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0432\u0441\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183295","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnera n\u00eb sistemin operativ Qubes q\u00eb lejon kalimin e izolimit dhe ekzekutimin e kodit n\u00eb nivelin Dom0 | ProHoster","description":"Informacioni mbi nj\u00eb vulnerabilitet n\u00eb sistemin operativ Qubes \u00ebsht\u00eb publikuar, i cili p\u00ebrdor nj\u00eb hipervizor p\u00ebr izolim t\u00eb fort\u00eb t\u00eb aplikacioneve dhe komponenteve t\u00eb OS (\u00e7do klas\u00eb aplikacionesh dhe sh\u00ebrbimet sistemike funksionojn\u00eb n\u00eb t\u00eb ndara.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/qubes-os-vulnerability-allows-isolation-bypass-and-code-execution-in-dom0","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u041e\u0421 Qubes, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 Dom0 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 Qubes, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0439 \u0433\u0438\u043f\u0435\u0440\u0432\u0438\u0437\u043e\u0440 \u0434\u043b\u044f \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041e\u0421 (\u043a\u0430\u0436\u0434\u044b\u0439 \u043a\u043b\u0430\u0441\u0441 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/qubes-os-vulnerability-allows-isolation-bypass-and-code-execution-in-dom0","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-08T20:53:24+00:00","article:modified_time":"2026-09-08T20:53:29+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183295","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=183295"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183295\/revisions"}],"predecessor-version":[{"id":183296,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/183295\/revisions\/183296"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=183295"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=183295"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=183295"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}