CVE-2021-20263

State: Published
Severity: Not scored
Published: Mar 9, 2021
Updated: Aug 3, 2024
Reserved: Dec 17, 2020

Description

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Scores

The record has no CVSS score.

Weaknesses

CWE-281

Affected Products

Product	Versions
QEMUn/a	qemu 5.2.50Affected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1933668
https://www.openwall.com/lists/oss-security/2021/03/08/1
https://security.netapp.com/advisory/ntap-20210507-0002/
GLSA-202208-27vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.