CVE-2023-1386

Publication date 24 July 2023

Last updated 16 January 2025

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

7.8 · High

Score breakdown

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.

Read the notes from the security team

Why is this CVE low priority?

Low severity issue, guest user could help host user escalate privileges

Learn more about Ubuntu priority

Status

Package Ubuntu Release Status
qemu 25.04 plucky
Vulnerable, fix deferred
24.10 oracular
Vulnerable, fix deferred
24.04 LTS noble
Vulnerable, fix deferred
23.10 mantic Ignored end of life, was deferred [2025-01-16]
23.04 lunar Ignored end of life, was deferred [2025-01-16]
22.10 kinetic Ignored end of life, was deferred [2025-01-16]
22.04 LTS jammy
Vulnerable, fix deferred
20.04 LTS focal
Vulnerable, fix deferred
18.04 LTS bionic
Vulnerable, fix deferred
16.04 LTS xenial
Vulnerable, fix deferred
14.04 LTS trusty
Vulnerable, fix deferred

Notes

mdeslaur

as of 2025-01-16, there is no upstream fix for this issue (The commits on May 12th, May 22nd, and Jan 6h are mistagged)

Severity score breakdown

Parameter Value
Base score 7.8 · High
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H