Vulnerability identifier: #VU39986

Vulnerability risk: Medium

CVSSv3.1: 5.5 [AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2016-7116

CWE-ID: CWE-22

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
QEMU
Client/Desktop applications / Virtualization software

Vendor: QEMU

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in hw/9pfs/9p.c in QEMU (aka Quick Emulator). A remote authenticated attacker can send a specially crafted HTTP request and local guest OS administrators to access host files outside the export path via a . (dot dot) in an unspecified string.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

QEMU: All versions

---

External links
http://git.qemu.org/?p=qemu.git;a=commit;h=56f101ecce0eafd09e2daf1c4eeb1377d6959261
http://www.openwall.com/lists/oss-security/2016/08/30/1
http://www.openwall.com/lists/oss-security/2016/08/30/3
http://www.securityfocus.com/bid/92680
http://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
http://lists.gnu.org/archive/html/qemu-devel/2016-08/msg03917.html
http://lists.gnu.org/archive/html/qemu-devel/2016-08/msg04231.html
http://security.gentoo.org/glsa/201609-01

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.