Bug 2167423 (CVE-2023-0664)
| Summary: | CVE-2023-0664 QEMU: local privilege escalation via the QEMU Guest Agent on Windows | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Yvugenfi <yvugenfi> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | ailan, ddepaula, haoliu, jferlan, kkostiuk, knoel, mdean, qizhu, virt-maint, vrozenfe, yvugenfi |
| Target Milestone: | --- | Keywords: | MigratedToJIRA, Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | qemu-kvm 8.0.0-rc0 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2167436, 2168242, 2175700, 2178028 | ||
| Bug Blocks: | 2156568 | ||
|
Description
Mauro Matteo Cascella
2023-02-06 15:30:33 UTC
Technical details: The cached installer for QEMU Guest Agent in c:\windows\installer (https://github.com/qemu/qemu/blob/master/qga/installer/qemu-ga.wxs) , can be leveraged to begin a repair of the installation without validation that the repair is being performed by an administrative user. The MSI repair custom action "RegisterCom" and "UnregisterCom" is not set for impersonation which allows for the actions to occur as the SYSTEM account (LINE 137 AND 145 of qemu-ga.wxs). The custom action also leverages cmd.exe to run qemu-ga.exe in line 134 and 142 which causes an interactive command shell to spawn even though the MSI is set to be non-interactive on line 53. Red Hat would like to thank Brian Wiltse for reporting this issue. Created qemu tracking bugs for this issue: Affects: fedora-all [bug 2175700] Upstream commits: https://gitlab.com/qemu-project/qemu/-/commit/88288c2a51faa7c795f053fc8b31b1c16ff804c5 https://gitlab.com/qemu-project/qemu/-/commit/07ce178a2b0768eb9e712bb5ad0cf6dc7fcf0158 This comment was flagged a spam, view the edit history to see the original text if required. (In reply to Velint from comment #16) > The vulnerability you described is a serious concern and should be addressed > promptly. It allows a local unprivileged user within a Windows VM to elevate > their privileges to the SYSTEM account, which could enable them to perform > malicious actions within the guest environment. Play > https://basketballrandom.com with your friend now! It was already fixed upstream and downstream. This comment was flagged a spam, view the edit history to see the original text if required. This comment was flagged a spam, view the edit history to see the original text if required. This comment was flagged a spam, view the edit history to see the original text if required. |