A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new xattrmap option may cause the security.capability xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Qemu | Qemu | 5.0.0 (including) | 5.2.50 (excluding) |
| Qemu | Ubuntu | trusty | * |