CVE-2021-20263
Low
Description
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
SeverityLow
CVSS3.3
Exploit probability—
ProductQemu
PublishedMar 9, 2021
First seenMar 9, 2021
Weakness typeCWE-281CWE-281
How to fix
Update
- qemu qemu5.2.50 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qemu qemu | 5.0.0 ≤ v < 5.2.50 | 5.2.50 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.