CVE-2022-0358

Name	CVE-2022-0358
Description	A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-5133-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qemu (PTS)	buster	1:3.1+dfsg-8+deb10u8	fixed
	buster (security)	1:3.1+dfsg-8+deb10u10	fixed
	bullseye (security), bullseye	1:5.2+dfsg-11+deb11u2	fixed
	bookworm, sid	1:7.2+dfsg-7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
qemu	source	stretch	(not affected)
qemu	source	buster	(not affected)
qemu	source	bullseye	1:5.2+dfsg-11+deb11u2	DSA-5133-1
qemu	source	(unstable)	1:7.0+dfsg-1

Notes

[buster] - qemu <not-affected> (Vulnerable code not present)
[stretch] - qemu <not-affected> (virtiofsd added in 5.0)
https://bugzilla.redhat.com/show_bug.cgi?id=2044863
https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca