A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
| Link | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1933668 | issue tracking third party advisory patch |
| https://www.openwall.com/lists/oss-security/2021/03/08/1 | mailing list third party advisory patch |
| https://security.netapp.com/advisory/ntap-20210507-0002/ | third party advisory |
| https://security.gentoo.org/glsa/202208-27 | third party advisory vendor advisory |