CVE-2020-35517

HIGH

qemu 5.0.0-5.2.50 - Privilege Escalation via virtio-fs Shared File System Device File Creation

Title source: llm
STIX 2.1

Description

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices.

References (6)

Core 6
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1915823
Exploit, Mailing List, Patch, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2021/01/22/1
Exploit, Mailing List, Patch, Third Party Advisory x_refsource_misc
https://lists.gnu.org/archive/html/qemu-devel/2021-01/msg05461.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210312-0002/
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202208-27

Scores

CVSS v3 8.2
EPSS 0.0008
EPSS Percentile 24.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-269
Status published
Products (1)
qemu/qemu 5.0.0 - 5.2.50
Published Jan 28, 2021
Tracked Since Feb 18, 2026