Skip to content
Commit 4d2c017f authored by Yanwu Shen's avatar Yanwu Shen Committed by Will Deacon
Browse files

Fix 9pfs open device file security flaw

Our team found that a public QEMU's 9pfs security issue[1] also exists
in upstream kvmtool's 9pfs device. A privileged guest user can create
and access the special device file (e.g., block files) in the shared
folder, allowing the malicious user to access the host device and
acheive privilege escalation.

The virtio_p9_open function code on the 9p.c only checks file directory
attributes, but does not check special files. Special device files can
be filtered on the device through the S_IFREG and S_IFDIR flag bits.

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2861
Link: https://lore.kernel.org/r/20240303183659.20656-1-ywsplz@gmail.com


Signed-off-by: default avatarYanwu Shen <ywsPlz@gmail.com>
Signed-off-by: default avatarWill Deacon <will@kernel.org>
parent e73a6b29
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment