Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
The Qubes security team has issued Qubes Security Bulletin (QSB) 118, warning of arbitrary code execution in QubesOS. The bulletin details a vulnerability in the qvm-copy-to-vm error reporting feature, which could allow attackers to execute malicious code within the Dom0 operating system. This Bulletin provides instructions on how to assess and mitigate the risk associated with this vulnerability.
The Qubes team has signed the QSB using their cryptographic PGP key, allowing users to verify its authenticity and ensure they are not misled by a forged bulletin. To confirm the QSB's validity, users must import and authenticate the Qubes Master Signing Key (QMSK) through a process involving GnuPG, a trusted cryptographic tool.
Once the QMSK's authentication is verified, users are advised to set its trust level to the highest "ultimate" setting. Afterward, users can verify the bulletin's associated signature files using the authenticated QMSK to ascertain the bulletin's legitimacy.
Written by urgent.news from Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
