CVE-2023-1386

Katalog CVE

CVSS 7.8 · High EPSS 0,24%

Kerentanan Improper Preservation of Permissions pada qemu, fedoraproject fedora. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.

Rincian

Terbit di NVD

24 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-281: Improper Preservation of Permissions

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 13,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2023-1386 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2223985 issue tracking · advisory pihak ketiga
• https://github.com/advisories/GHSA-ppj8-867g-rgjr
• https://github.com/v9fs/linux/issues/29
• https://security.netapp.com/advisory/ntap-20230831-0005/