Vulnerability · Published Aug 29, 2022 · Assigned by redhat
CVE-2022-0358
High 7.8
In plain English
A high-severity security flaw in QEMU/virtiofsd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libiscsi | 1.18.0-8.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | libiscsi-devel | 1.18.0-8.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | libiscsi-utils | 1.18.0-8.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | libvirt-dbus | 1.3.0-2.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | netcf | 0.2.8-12.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | netcf-devel | 0.2.8-12.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | netcf-libs | 0.2.8-12.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-guest-agent | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-img | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm-block-curl | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm-block-gluster | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm-block-iscsi | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm-block-rbd | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm-block-ssh | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm-common | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | qemu-kvm-core | 15:4.2.0-59.module_el8.5.0+2629+68d2f392.2 | ALSA-2022:0886 |
| AlmaLinux:8 | sgabios | 1:0.20170427git-3.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| AlmaLinux:8 | sgabios-bin | 1:0.20170427git-3.module_el8.6.0+2880+7d9e3703 | ALSA-2022:0886 |
| Debian:12 | qemu | 1:7.0+dfsg-1 | DEBIAN-CVE-2022-0358 |
| Debian:13 | qemu | 1:7.0+dfsg-1 | DEBIAN-CVE-2022-0358 |
| Debian:14 | qemu | 1:7.0+dfsg-1 | DEBIAN-CVE-2022-0358 |
| Rocky Linux:8 | hivex | 0:1.3.18-21.module+el8.5.0+670+c4aa478c | RLSA-2022:0886 |
| Rocky Linux:8 | hivex | 0:1.3.18-21.module+el8.4.0+642+7e26f5e1 | RLSA-2022:0886 |
| Rocky Linux:8 | libguestfs | 1:1.40.2-28.module+el8.5.0+670+c4aa478c | RLSA-2022:0886 |
| Rocky Linux:8 | libguestfs-winsupport | 0:8.2-1.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | libiscsi | 0:1.18.0-8.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | libiscsi | 0:1.18.0-8.module+el8.7.0+1084+97b81f61 | RLSA-2022:0886 |
| Rocky Linux:8 | libiscsi | 0:1.18.0-8.module+el8.6.0+847+b490afdd | RLSA-2022:0886 |
| Rocky Linux:8 | libnbd | 0:1.2.2-1.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | libvirt | 0:6.0.0-37.1.module+el8.5.0+732+d204e9f7 | RLSA-2022:0886 |
| Rocky Linux:8 | libvirt-dbus | 0:1.3.0-2.module+el8.7.0+1084+97b81f61 | RLSA-2022:0886 |
| Rocky Linux:8 | libvirt-dbus | 0:1.3.0-2.module+el8.6.0+847+b490afdd | RLSA-2022:0886 |
| Rocky Linux:8 | libvirt-dbus | 0:1.3.0-2.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | libvirt-python | 0:6.0.0-1.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | nbdkit | 0:1.16.2-4.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | netcf | 0:0.2.8-12.module+el8.7.0+1084+97b81f61 | RLSA-2022:0886 |
| Rocky Linux:8 | netcf | 0:0.2.8-12.module+el8.6.0+847+b490afdd | RLSA-2022:0886 |
| Rocky Linux:8 | netcf | 0:0.2.8-12.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | perl-Sys-Virt | 0:6.0.0-1.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | qemu-kvm | 5:4.2.0-59.module+el8.5.0+670+c4aa478c | RLSA-2022:0886 |
| Rocky Linux:8 | seabios | 0:1.13.0-2.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | sgabios | 1:0.20170427git-3.module+el8.6.0+847+b490afdd | RLSA-2022:0886 |
| Rocky Linux:8 | sgabios | 1:0.20170427git-3.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Rocky Linux:8 | sgabios | 1:0.20170427git-3.module+el8.7.0+1084+97b81f61 | RLSA-2022:0886 |
| Rocky Linux:8 | supermin | 0:5.1.19-10.module+el8.4.0+534+4680a14e | RLSA-2022:0886 |
| Ubuntu:22.04:LTS | qemu | 1:6.2+dfsg-2ubuntu6.2 | USN-5489-1 |
| Ubuntu:22.04:LTS | qemu | 1:6.2+dfsg-2ubuntu6.2 | UBUNTU-CVE-2022-0358 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | QEMU/virtiofsd | Fixed in qemu v6.2.0-7 |
Weakness: CWE-273