Fix 9pfs open device file security flaw
Our team found that a public QEMU's 9pfs security issue[1] also exists in upstream kvmtool's 9pfs device. A privileged guest user can create and access the special device file (e.g., block files) in the shared folder, allowing the malicious user to access the host device and acheive privilege escalation. The virtio_p9_open function code on the 9p.c only checks file directory attributes, but does not check special files. Special device files can be filtered on the device through the S_IFREG and S_IFDIR flag bits. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2861 Link: https://lore.kernel.org/r/20240303183659.20656-1-ywsplz@gmail.com Signed-off-by:Yanwu Shen <ywsPlz@gmail.com> Signed-off-by:
Will Deacon <will@kernel.org>
Loading
Please register or sign in to comment