CVE-2020-35517
📋 TL;DR
This vulnerability allows a privileged guest user in a QEMU virtual machine with virtio-fs shared directories to create device special files that provide read/write access to host devices. It affects systems running QEMU with virtio-fs enabled where untrusted guests have access to shared directories. This enables privilege escalation from guest to host.
💻 Affected Systems
- QEMU
- libvirt
- virt-manager
- OpenStack
- oVirt
- Proxmox VE
- KVM virtualization stacks
📦 What is this software?
Qemu by Qemu
⚠️ Risk & Real-World Impact
Worst Case
A malicious guest administrator can access sensitive host devices (like storage, memory, or network interfaces) leading to full host compromise, data theft, or denial of service.
Likely Case
Privileged guest users escape virtualization boundaries to access host filesystems or devices they shouldn't have access to, potentially modifying system files or accessing sensitive data.
If Mitigated
If proper access controls are in place and shared directories contain only non-sensitive data, impact is limited to the shared directory contents.
🎯 Exploit Status
Exploitation requires guest administrator privileges. Proof-of-concept code is available in the bug reports and patches.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: QEMU 5.2.0 and later
Vendor Advisory: https://security.gentoo.org/glsa/202208-27
Restart Required: Yes
Instructions:
1. Update QEMU to version 5.2.0 or later. 2. For distributions: Use package manager (apt/yum/dnf) to update qemu packages. 3. Restart affected virtual machines. 4. Verify virtio-fs daemon is updated.
🔧 Temporary Workarounds
Disable virtio-fs shared directories
linuxRemove or disable virtio-fs shared directory configurations between host and untrusted guests
# Edit VM configuration to remove virtio-fs shared directories
# Check for virtiofsd processes: ps aux | grep virtiofs
# Stop virtiofsd if not needed
Use alternative file sharing methods
linuxReplace virtio-fs with 9p filesystem or other secure sharing mechanisms
# Configure VM with -virtfs instead of -device virtio-fs-pci
# Example: -virtfs local,path=/shared,mount_tag=host0,security_model=mapped
🧯 If You Can't Patch
- Isolate virtio-fs shared directories to contain only non-sensitive, non-critical data
- Implement strict access controls and monitoring for guest users with shared directory access
🔍 How to Verify
Check if Vulnerable:
Check QEMU version and if virtio-fs is enabled: qemu-system-x86_64 --version | grep -E '5\.(0|1)\.' and check VM config for virtio-fs devicesCheck Version:
qemu-system-x86_64 --version | head -1Verify Fix Applied:
Verify QEMU version is 5.2.0+: qemu-system-x86_64 --version | grep -E '5\.2\.|6\.|7\.'📡 Detection & Monitoring
Log Indicators:
- Guest creating device nodes in shared directories
- Unexpected access to host device files from virtiofsd process
Network Indicators:
- Not network exploitable - local privilege escalation
SIEM Query:
process.name=virtiofsd AND file.path=/dev/* AND file.operation=create🔗 References
- https://bugzilla.redhat.com/show_bug.cgi?id=1915823
- https://github.com/qemu/qemu/commit/ebf101955ce8f8d72fba103b5151115a4335de2c
- https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg05461.html
- https://security.gentoo.org/glsa/202208-27
- https://security.netapp.com/advisory/ntap-20210312-0002/
- https://www.openwall.com/lists/oss-security/2021/01/22/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1915823
- https://github.com/qemu/qemu/commit/ebf101955ce8f8d72fba103b5151115a4335de2c
- https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg05461.html
- https://security.gentoo.org/glsa/202208-27
- https://security.netapp.com/advisory/ntap-20210312-0002/
- https://www.openwall.com/lists/oss-security/2021/01/22/1
