CVE-2023-2861

Name
CVE-2023-2861
Description
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
vdb-entry https://access.redhat.com/security/cve/CVE-2023-2861
issue-tracking https://bugzilla.redhat.com/show_bug.cgi?id=2219266
patrick@puiterwijk.org https://security.netapp.com/advisory/ntap-20240125-0005/
patrick@puiterwijk.org https://lists.debian.org/debian-lts-announce/2024/03/msg00012.html
patrick@puiterwijk.org https://security.netapp.com/advisory/ntap-20240229-0002/

Match rules

CPE URI Source package Min version Max version
shopxo >= 8.1.0-rc0 < *

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
qemu edge-community 8.0.2-r1 Natanael Copa <ncopa@alpinelinux.org> fixed
qemu 3.22-community 8.0.2-r1 None fixed
qemu 3.21-community 8.0.2-r1 None fixed
qemu 3.20-community 8.0.2-r1 None fixed
qemu 3.19-community 8.0.2-r1 None fixed
qemu 3.18-community 8.0.2-r1 Natanael Copa <ncopa@alpinelinux.org> fixed