A Crafted Filename Could Hand a Compromised Qube Control of Qubes OS Dom0

Qubes OS has patched a flaw that let a compromised qube run commands in dom0, the privileged domain that controls the whole system, by abusing nothing more exotic than an error message. The project disclosed the bug on Saturday in Qubes Security Bulletin 118 and said all Qubes OS releases are affected.

Exploitation needs two things: an attacker who already controls a qube, and a user who copies a file from dom0 into that qube with qvm-copy-to-vm. If both happen, “the attacker can exploit this vulnerability in order to inject an arbitrary command into dom0, which allows the attacker to take control of Qubes OS,” the bulletin says.

A filename in an error dialog

qvm-copy-to-vm uses Qubes’ “qfile” protocol, a simple archive format the bulletin describes as “much simpler than tar or cpio.” At the end of a transfer, the receiving qube sends back a confirmation with a checksum, an error code if something went wrong, and the name of the last file it received. On an error, dom0 pops up a GUI message that includes that filename as reported by the target qube.

Before display, the name passes through sanitize_remote_filename() in linux-utils/qrexec-lib/pack.c, which replaces control characters, non-ASCII characters and double quotes with underscores. Shell metacharacters pass straight through. The dom0 error routine, display_error() in core-admin-linux/file-copy-vm/qfile-dom0-agent.c, then uses asprintf() to build a kdialog or zenity command line containing the message and hands it to system(), so a qube that reports an error with a crafted filename gets its payload run by the shell in dom0.

The VM-side version of the tool isn’t vulnerable. Its error function drops privileges and launches zenity or kdialog with execlp(), passing the message as an argument without going through a shell.

Getting the fix

For Qubes 4.3 the fix is in qubes-core-dom0-linux 4.3.22. The package starts in the security-testing repository and moves to the stable repository after a short community testing period; users only need to keep updating normally through the Qubes Update tool or its command-line equivalents. “No other user action is required in response to this QSB,” the bulletin says. Until the update lands, the bug can only be triggered by copying from dom0 into a qube that is already compromised.

The bulletin, signed with the project’s PGP keys, credits the discovery to a researcher identified as Tim C.