Sårbarhet i Qubes OS som möjliggör omdirigering av isolering och körning av kod på Dom0-nivå

Information has been published about a vulnerability in the Qubes operating system, which uses a hypervisor for strict isolation of applications and OS components (each class of applications and system services runs in separate virtual machines). If an attacker compromises one of the virtual machines, the vulnerability allows bypassing isolation, executing arbitrary commands in the host environment (Dom0), and taking control of the entire operating system. The issue occurs when a user employs the "qvm-copy-to-vm" utility to copy a file from the host environment to a virtual machine controlled by the attacker. The vulnerability has been addressed in the package update qubes-core-dom0-linux 4.3.22.

The issue exists in the "qvm-copy-to-vm" utility and is caused by inadequate error handling when accessing en virtuell maskin. The essence of the vulnerability is that the qvm-copy-to-vm utility, to display error information, would invoke the kdialog or zenity programs using the system() function and passing details about the unsuccessfully copied file among options in the command line. The cleaning of the filename was limited to removing non-ASCII characters and double quotes without checking for the presence of special characters interpreted by the command shell, such as "`" and "$".

After the file copying process from the host system is completed, the handler on the virtual machine side returns a confirmation of the operation, which includes the name of the last received file. The attack consists of returning an error code instead of a confirmation and providing the filename of the file that failed to copy with special characters processed by the command interpreter. Upon receiving the error, the handler on the host environment side will invoke the utility to show a dialog with the error message using the system() command, passing the filename returned by the attacker in the command line (for example, if "file`id`" is specified, the command id will be executed on the host side).

Källa: opennet.ru