Qubes Os
Monthly
OS command injection in Qubes OS (qubes-core-dom0-linux before 4.3.22) allows an attacker who controls any qube to execute arbitrary commands in dom0 - the privileged hypervisor control domain - when a dom0 operator runs qvm-copy-to-vm targeting that attacker-controlled qube. The root cause (CWE-78) is qfile-dom0-agent.c passing unsanitized, attacker-crafted error messages to the C system() function, where embedded shell metacharacters are interpreted as commands in the dom0 shell context. No public exploit or CISA KEV listing has been identified; however, successful exploitation yields complete Qubes OS compromise because dom0 governs all other virtual machines on the system.
OS command injection in Qubes OS (qubes-core-dom0-linux before 4.3.22) allows an attacker who controls any qube to execute arbitrary commands in dom0 - the privileged hypervisor control domain - when a dom0 operator runs qvm-copy-to-vm targeting that attacker-controlled qube. The root cause (CWE-78) is qfile-dom0-agent.c passing unsanitized, attacker-crafted error messages to the C system() function, where embedded shell metacharacters are interpreted as commands in the dom0 shell context. No public exploit or CISA KEV listing has been identified; however, successful exploitation yields complete Qubes OS compromise because dom0 governs all other virtual machines on the system.