Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel

	Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel(qubes-os.org)
	244 points by vntok 11 days ago \| 96 comments
	tl;dr: QubesOS QSB-118 discloses a vulnerability in `qvm-copy-to-vm` where a malicious target VM can inject arbitrary commands into dom0 via the error-reporting backchannel. The dom0 error handler passes an attacker-controlled filename to `system()`, and the sanitization function only strips non-ASCII characters and double quotes while leaving shell metacharacters intact. All Qubes OS releases are affected; a fix is available in `qubes-core-dom0-linux` 4.3.22 for Qubes 4.3.
	HN Discussion: ~The attack surface is small and low impact since copying from dom0 is rare ↑Serious vulnerability that highlights how even well-designed secure systems have flaws ↑This is a basic C/shell security failure that should have been caught in review, especially given prior documentation ↑Reinforces that security boundaries depend on mundane peripheral utilities, not just core layers •Questions or tangents about QubesOS design compared to alternatives like BSD jails or hardware acceleration limits