Qemu: 9pfs: improper access control on special files

CVE-2023-2861

Summary

A vulnerability has been identified in QEMU's implementation of the 9p passthrough filesystem (9pfs). This flaw allows a malicious client to exploit the absence of restrictions on special file access on the host side. By creating and opening a device file within a shared folder, attackers can escape the intended boundaries of the exported 9p tree, potentially leading to unauthorized access to host resources. Organizations using affected versions of QEMU should evaluate their security posture and apply necessary updates.

References