Bug 958993 (CVE-2015-8556) - VUL-1: CVE-2015-8556: qemu: Local Privilege Escalation in QEMU virtfs-proxy-helper
Summary: VUL-1: CVE-2015-8556: qemu: Local Privilege Escalation in QEMU virtfs-proxy-h...
Status: RESOLVED INVALID
Alias: CVE-2015-8556
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: E-mail List
QA Contact: Security Team bot
URL:
Whiteboard: CVSSv2:SUSE:CVE-2015-8556:6.0:(AV:L/A...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-14 14:48 UTC by Marcus Meissner
Modified: 2016-04-27 20:10 UTC (History)
1 user (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2015-12-14 14:48:17 UTC 
public via oss-sec

no cve yet

From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Subject: [oss-security] CVE Request: Local Privilege Escalation in QEMU virtfs-proxy-helper
Date: Mon, 14 Dec 2015 12:14:39 +0100

Hi folks,

Some distros make qemu's virtfs-proxy-helper binary either SUID or
give it filesystem capabilities such as cap_chown. This is completely
insane for a wide variety of reasons; there are quite a few ways of
abusing this to elevate privileges.

This commit fixes the issue in Gentoo:

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=183dd7394703b49c7af441a9c4227b4b91453510

The commit message contains a TOCTOU PoC.

Can we get a CVE for this blunder?

Other distributions - you might want to double check that you're not
making a similar mistake.

I have no idea if QEMU upstream recommends suid/fscaps in some
documentation, or something similar, in which case that'll need to be
changed.

Thanks,
Jason
Comment 1 Marcus Meissner 2015-12-14 14:49:30 UTC 
Note that this helper has no special privileges on SUSE or openSUSE, so we are not affected.
Comment 2 Swamp Workflow Management 2015-12-14 23:00:59 UTC 
bugbot adjusting priority
Comment 3 Bruce Rogers 2016-01-05 19:16:12 UTC 
(In reply to Marcus Meissner from comment #1)
> Note that this helper has no special privileges on SUSE or openSUSE, so we
> are not affected.

Agreed. Not an issue in our releases.