CVE-2023-2861 - OpenCVE

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Qemu	Qemu

Configuration 1 [-]

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2023-2861
https://bugzilla.redhat.com/show_bug.cgi?id=2219266
https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html
https://nvd.nist.gov/vuln/detail/CVE-2023-2861
https://security.netapp.com/advisory/ntap-20240125-0005/
https://security.netapp.com/advisory/ntap-20240229-0002/
https://www.cve.org/CVERecord?id=CVE-2023-2861

History

No history.

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2023-12-06T06:19:40.625Z

Updated: 2024-08-02T06:33:05.791Z

Reserved: 2023-05-24T07:54:12.009Z

Link: CVE-2023-2861

Vulnrichment

Updated: 2024-08-02T06:33:05.791Z

NVD

Status : Modified

Published: 2023-12-06T07:15:41.430

Modified: 2024-03-11T18:15:15.687

Link: CVE-2023-2861

Redhat

Severity : Low

Publid Date: 2023-06-07T00:00:00Z

Links: CVE-2023-2861 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-2861", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2023-05-24T07:54:12.009Z", "datePublished": "2023-12-06T06:19:40.625Z", "dateUpdated": "2024-08-02T06:33:05.791Z"}, "containers": {"cna": {"title": "Qemu: 9pfs: improper access control on special files", "metrics": [{"other": {"content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder."}], "affected": [{"versions": [{"status": "unaffected", "version": "8.1.0-rc0", "lessThan": "*", "versionType": "semver"}], "packageName": "qemu", "collectionURL": "https://gitlab.com/qemu-project/qemu", "defaultStatus": "affected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-2861", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219266", "name": "RHBZ#2219266", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html"}, {"url": "https://security.netapp.com/advisory/ntap-20240125-0005/"}, {"url": "https://security.netapp.com/advisory/ntap-20240229-0002/"}], "datePublic": "2023-06-07T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "Improper Access Control", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-284: Improper Access Control", "timeline": [{"lang": "en", "time": "2023-05-16T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-06-07T00:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Jietao Xiao, Jinku Li, Wenbo Shen, and Yanwu Shen for reporting this issue."}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-04-19T13:40:08.248Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2861", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-24T16:40:48.930612Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*"], "vendor": "qemu", "product": "qemu", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.1.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:16:52.155Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:33:05.791Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-2861", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219266", "name": "RHBZ#2219266", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240125-0005/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240229-0002/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-2861", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219266", "name": "RHBZ#2219266", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240125-0005/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240229-0002/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T06:33:05.791Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-2861", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-01-24T16:40:48.930612Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:qemu:qemu:-:*:*:*:*:*:*:*"], "vendor": "qemu", "product": "qemu", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.1.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-29T18:37:17.196Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Qemu: 9pfs: improper access control on special files", "credits": [{"lang": "en", "value": "Red Hat would like to thank Jietao Xiao, Jinku Li, Wenbo Shen, and Yanwu Shen for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Low", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"versions": [{"status": "unaffected", "version": "8.1.0-rc0", "lessThan": "*", "versionType": "semver"}], "packageName": "qemu", "collectionURL": "https://gitlab.com/qemu-project/qemu", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2023-05-16T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2023-06-07T00:00:00+00:00", "value": "Made public."}], "datePublic": "2023-06-07T00:00:00+00:00", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-2861", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219266", "name": "RHBZ#2219266", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html"}, {"url": "https://security.netapp.com/advisory/ntap-20240125-0005/"}, {"url": "https://security.netapp.com/advisory/ntap-20240229-0002/"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Control"}]}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-04-19T13:40:08.248Z"}, "x_redhatCweChain": "CWE-284: Improper Access Control"}}, "cveMetadata": {"cveId": "CVE-2023-2861", "state": "PUBLISHED", "dateUpdated": "2024-08-02T06:33:05.791Z", "dateReserved": "2023-05-24T07:54:12.009Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2023-12-06T06:19:40.625Z", "assignerShortName": "fedora"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*", "matchCriteriaId": "A178AFEF-359C-427C-99C6-EC003039FF3B", "versionEndExcluding": "8.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en la implementaci\u00f3n del sistema de archivos de paso 9p (9pfs) en QEMU. El servidor 9pfs no prohib\u00eda la apertura de archivos especiales en el lado del host, lo que potencialmente permit\u00eda que un cliente malicioso escapara del \u00e1rbol 9p exportado creando y abriendo un archivo de dispositivo en la carpeta compartida."}], "id": "CVE-2023-2861", "lastModified": "2024-03-11T18:15:15.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.2, "source": "patrick@puiterwijk.org", "type": "Secondary"}]}, "published": "2023-12-06T07:15:41.430", "references": [{"source": "patrick@puiterwijk.org", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2023-2861"}, {"source": "patrick@puiterwijk.org", "tags": ["Issue Tracking", "Patch"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219266"}, {"source": "patrick@puiterwijk.org", "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html"}, {"source": "patrick@puiterwijk.org", "url": "https://security.netapp.com/advisory/ntap-20240125-0005/"}, {"source": "patrick@puiterwijk.org", "url": "https://security.netapp.com/advisory/ntap-20240229-0002/"}], "sourceIdentifier": "patrick@puiterwijk.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "patrick@puiterwijk.org", "type": "Secondary"}]}