Vulnerability · Published Mar 9, 2021 · Assigned by redhat
CVE-2021-20263
Low 3.3
In plain English
A low-severity security flaw in QEMU. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)3.3Low
Exploit odds (30 days)0.4%top 68.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | qemu | 1:5.2+dfsg-9 | DEBIAN-CVE-2021-20263 |
| Debian:13 | qemu | 1:5.2+dfsg-9 | DEBIAN-CVE-2021-20263 |
| Debian:14 | qemu | 1:5.2+dfsg-9 | DEBIAN-CVE-2021-20263 |
Affected products (as reported)
Weakness: CWE-281
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1933668 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2021/03/08/1 x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210507-0002/ x_refsource_CONFIRM
- GLSA-202208-27 vendor-advisory, x_refsource_GENTOO