Published information about a vulnerability in the operating system Qubes reveals a security issue that could potentially allow attackers to compromise the system. Qubes OS utilizes a hypervisor to strictly isolate applications and OS components by running each class of applications and system services in separate virtual machines. However, if an attacker compromises one of the virtual machines, the vulnerability could enable them to bypass isolation, execute arbitrary commands in the host environment (Dom0), and take control of the entire operating system. The vulnerability arises when a user utilizes the “qvm-copy-to-vm” utility to transfer a file from the host environment to a virtual machine controlled by the attacker. This security flaw has been addressed in the qubes-core-dom0-linux package update 4.3.22.
The issue stems from the qvm-copy-to-vm utility and is caused by improper error handling when accessing the virtual machine. The vulnerability occurs in the qvm-copy-to-vm utility, where error information is displayed using the system() function to run the kdialog or zenity programs. However, the utility fails to adequately sanitize the file name, only removing non-ASCII characters and double quotes, without checking for special characters that could be interpreted by the command shell, such as “‘” and “$”.
When files are copied from the host system, the handler on the virtual machine side sends confirmation of the operation, including the name of the last received file. The attack exploits this process by returning an error code instead of confirmation and specifying a file name with special characters that may be processed by the command interpreter on the host environment side. Upon encountering an error, the handler on the host side will execute a utility using the system() command to display an error dialog, unwittingly executing commands specified by the attackers in the file name, leading to potential security breaches.