Bug 1213501 (CVE-2023-1386) - VUL-0: CVE-2023-1386: kvm,qemu: QEMU: 9pfs: SUID/SGID bits not dropped on file write
Summary: VUL-0: CVE-2023-1386: kvm,qemu: QEMU: 9pfs: SUID/SGID bits not dropped on fil...
Status: NEW
Alias: CVE-2023-1386
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: E-mail List
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/372982/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-1386:3.3:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-20 06:58 UTC by Robert Frohl
Modified: 2023-08-08 10:12 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2023-07-20 06:58:57 UTC 
CVE-2023-1386

A flaw was discovered in 9pfs. Jietao Xiao and his team found that when a local user in the guest tries to write an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances(exist an executable file owned by root, writable by others, has SUID/SGID bits), this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host's local user to elevate privileges on the host.

Upstream issue:
https://github.com/v9fs/linux/issues/29

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-1386
https://bugzilla.redhat.com/show_bug.cgi?id=2223985