Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HQemu
APPQemu2.9.0≤ 2.8.1.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References
Related vulnerabilities
CVE-2022-36648CRITICAL10.0PL ✓same product
NULL pointer dereference w emulacji urządzenia rocker w QEMU
CVE-2019-12928CRITICAL9.8PL ✓same product
QEMU: command injection w interfejsie QMP umożliwia RCE
CVE-2019-12929CRITICAL9.8PL ✓same product
Command injection w QEMU poprzez komendę QMP guest_exec
CVE-2018-20815CRITICAL9.8PL ✓same product
Buffer overflow w QEMU — funkcja load_image w device_tree.c
CVE-2018-17963CRITICAL9.8PL ✓same product
QEMU: przepełnienie liczby całkowitej w obsłudze pakietów sieciowych (CWE-190)