CVE-2022-0358

Katalog CVE

CVSS 7.8 · High EPSS 0,33%

Kerentanan Improper Check for Dropped Privileges pada qemu, redhat enterprise linux. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.

Rincian

Terbit di NVD

29 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-273: Improper Check for Dropped Privileges

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=2044863 issue tracking · patch · advisory pihak ketiga
• https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca patch · advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2022-0358 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20221007-0008/ advisory pihak ketiga