Description

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.9",
  "pubDate": "2026-08-30T14:17:03.310Z",
  "pubdate": "2026-08-30T14:17:03.310Z",
  "executiveSummary": "A critical OS command injection vulnerability exists in Qubes OS, specifically within the qvm-copy-to-vm utility of the qubes-core-dom0-linux package prior to version 4.3.22.\nThe flaw allows an attacker-controlled qube to achieve code execution within the privileged dom0 domain by triggering a specifically crafted error message during file transfer operations.\nThe vulnerability stems from the improper use of the system library function to process error messages containing shell metacharacters, effectively bypassing the security isolation between dom0 and guest VMs.\nSuccessful exploitation grants an attacker the ability to execute arbitrary commands with dom0 privileges, leading to a complete compromise of the Qubes OS security model, including the ability to bypass isolation and access sensitive data across all qubes.\nThis vulnerability represents a significant risk to the integrity of the Qubes OS platform, as it transforms a compromised guest qube into a vector for dom0 privilege escalation.\nNo complex exploitation requirements are noted beyond the attacker having control over a qube that engages in a qvm-copy-to-vm operation with dom0.",
  "technicalDetails": "The vulnerability is located in the core-admin-linux/file-copy-vm/qfile-dom0-agent.c component of the Qubes OS architecture.\nThe root cause is the insecure invocation of the C standard library function system() to handle error messages generated during the qvm-copy-to-vm process.\nThe qfile-dom0-agent.c implementation fails to sanitize input derived from the communication channel with the target qube, allowing shell metacharacters injected by an attacker to be interpreted by the command shell when the error message is processed.\nWhen a user or process initiates a qvm-copy-to-vm call from dom0 to a guest qube, the agent prepares to handle potential errors that occur during the file transfer interaction.\nIf an attacker controls the destination qube, they can deliberately induce an error condition that forces the agent in dom0 to process a malicious error string.\nBecause this string is passed directly into a system() call, the underlying shell interprets the payload as executable commands rather than plain text data, leading to command injection.\nThe affected versions include qubes-core-dom0-linux versions prior to 4.3.22.\nExploitation requires no authentication in the traditional sense, as the vulnerability is triggered via the legitimate inter-qube communication mechanisms established by the Qubes OS core admin tools.\nPrivilege escalation is the primary impact: since the agent runs within the context of dom0, any code executed via this injection runs with full administrative control over the management domain.\nThe post-exploitation impact includes the potential for persistent backdooring of the dom0 environment, exfiltration of cryptographic keys, modification of qube configurations, and full subversion of the hypervisor management layer.\nNetwork exposure is not a primary factor, as the attack is facilitated by the internal Qubes inter-VM communication protocol (qrexec).\nThe vulnerability illustrates a failure to observe secure coding practices when interacting with shell environments, specifically the dangerous combination of external input and the system() function, which necessitates proper shell escaping or the use of safer exec-family functions that do not invoke the shell interpreter."
}