{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-0358", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2024-08-02T23:25:40.534Z", "dateReserved": "2022-01-25T00:00:00", "datePublished": "2022-08-29T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2022-10-07T00:00:00"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system."}], "affected": [{"vendor": "n/a", "product": "QEMU/virtiofsd", "versions": [{"version": "Fixed in qemu v6.2.0-7", "status": "affected"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044863"}, {"url": "https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca"}, {"url": "https://access.redhat.com/security/cve/CVE-2022-0358"}, {"url": "https://security.netapp.com/advisory/ntap-20221007-0008/"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-273 - Improper Check for Dropped Privileges.", "cweId": "CWE-273"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:25:40.534Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044863", "tags": ["x_transferred"]}, {"url": "https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca", "tags": ["x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2022-0358", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20221007-0008/", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*", "matchCriteriaId": "F3FC90C9-CD0D-4EAB-9B58-864629CF69D3", "versionEndExcluding": "6.2.0-7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*", "matchCriteriaId": "3AA08768-75AF-4791-B229-AE938C780959", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system."}, {"lang": "es", "value": "Se ha encontrado un fallo en la implementaci\u00f3n del demonio del sistema de archivos compartidos de QEMU virtio-fs (virtiofsd). Este fallo est\u00e1 estrictamente relacionado con CVE-2018-13405. Un usuario invitado local puede crear archivos en los directorios compartidos por virtio-fs con propiedad de grupo no intencionada en un escenario en el que un directorio es SGID a un determinado grupo y es escribible por un usuario que no es miembro del grupo. Esto podr\u00eda permitir a un usuario malicioso no privilegiado dentro del hu\u00e9sped conseguir acceso a recursos accesibles al grupo root, escalando potencialmente sus privilegios dentro del hu\u00e9sped. Un usuario local malicioso en el hu\u00e9sped tambi\u00e9n podr\u00eda aprovechar este archivo ejecutable no esperado creado por el hu\u00e9sped para escalar sus privilegios en el sistema hu\u00e9sped"}], "id": "CVE-2022-0358", "lastModified": "2022-12-09T18:00:15.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-08-29T15:15:09.310", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2022-0358"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044863"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20221007-0008/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-273"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-273"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank Jietao Xiao (shawtao1125@gmail.com), Jinku Li (jkli@xidian.edu.cn), Nanzi Yang (nzyang@stu.xidian.edu.cn), and Wenbo Shen (shenwenbo@zju.edu.cn) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2022:0973", "cpe": "cpe:/a:redhat:advanced_virtualization:8.2::el8", "package": "virt:8.2-8020120220211042301.863bb0db", "product_name": "Advanced Virtualization for RHEL 8.2.1", "release_date": "2022-03-21T00:00:00Z"}, {"advisory": "RHSA-2022:0973", "cpe": "cpe:/a:redhat:advanced_virtualization:8.2::el8", "package": "virt-devel:8.2-8020120220211042301.863bb0db", "product_name": "Advanced Virtualization for RHEL 8.2.1", "release_date": "2022-03-21T00:00:00Z"}, {"advisory": "RHSA-2022:0971", "cpe": "cpe:/a:redhat:advanced_virtualization:8.4::el8", "package": "virt:av-8040020220210233846.522a0ee4", "product_name": "Advanced Virtualization for RHEL 8.4.0.EUS", "release_date": "2022-03-21T00:00:00Z"}, {"advisory": "RHSA-2022:0971", "cpe": "cpe:/a:redhat:advanced_virtualization:8.4::el8", "package": "virt-devel:av-8040020220210233846.522a0ee4", "product_name": "Advanced Virtualization for RHEL 8.4.0.EUS", "release_date": "2022-03-21T00:00:00Z"}, {"advisory": "RHSA-2022:0949", "cpe": "cpe:/a:redhat:advanced_virtualization:8.5::el8", "package": "virt:av-8050020220210180726.c5368500", "product_name": "Advanced Virtualization for RHEL 8.5.0.Z", "release_date": "2022-03-16T00:00:00Z"}, {"advisory": "RHSA-2022:0949", "cpe": "cpe:/a:redhat:advanced_virtualization:8.5::el8", "package": "virt-devel:av-8050020220210180726.c5368500", "product_name": "Advanced Virtualization for RHEL 8.5.0.Z", "release_date": "2022-03-16T00:00:00Z"}, {"advisory": "RHSA-2022:0886", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "virt-devel:rhel-8050020220208234339.c5368500", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-03-15T00:00:00Z"}, {"advisory": "RHSA-2022:0886", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "virt:rhel-8050020220208234339.c5368500", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2022-03-15T00:00:00Z"}, {"advisory": "RHSA-2022:0759", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "virt-devel:rhel-8040020220214155039.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-03-07T00:00:00Z"}, {"advisory": "RHSA-2022:0759", "cpe": "cpe:/a:redhat:rhel_eus:8.4", "package": "virt:rhel-8040020220214155039.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Extended Update Support", "release_date": "2022-03-07T00:00:00Z"}], "bugzilla": {"description": "QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405", "id": "2044863", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044863"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-273", "details": ["A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.", "A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-0358", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "qemu-kvm-ma", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:advanced_virtualization:8::el8", "fix_state": "Affected", "package_name": "virt:8.2/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8 Advanced Virtualization"}, {"cpe": "cpe:/a:redhat:advanced_virtualization:8::el8", "fix_state": "Affected", "package_name": "virt:av/qemu-kvm", "product_name": "Red Hat Enterprise Linux 8 Advanced Virtualization"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "qemu-kvm", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openstack:10", "fix_state": "Out of support scope", "package_name": "qemu-kvm-rhev", "product_name": "Red Hat OpenStack Platform 10 (Newton)"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "qemu-kvm-rhev", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}], "public_date": "2022-01-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-0358\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-0358"], "statement": "This issue does not affect the versions of the `qemu-kvm` package as shipped with Red Hat Enterprise Linux 6 and 7. Virtio-fs is a fairly new feature (introduced upstream in QEMU v5.0) which is not built in Red Hat Enterprise Linux 6 and 7.", "threat_severity": "Moderate", "upstream_fix": "qemu 6.2.0-7"}