p PatchFirst

CVE-2021-20263

CVE-2021-20263

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

CVSS 3.3 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • qemu

    Versions
    • qemu 5.2.50: Affected

    No fix published

  • qemu Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:5.2+dfsg-9

    Update to 1:5.2+dfsg-9

  • qemu Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:5.2+dfsg-9

    Update to 1:5.2+dfsg-9

  • qemu Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:5.2+dfsg-9

    Update to 1:5.2+dfsg-9

Original sources

Check your server →