VDB
DEBIAN-CVE-2023-2861
DEBIAN-CVE-2023-2861
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | qemu | 0, 1:7.2+dfsg-7, 0 |
| Debian:11 | qemu | 1:9.1.0~rc0+ds-2, 1:9.2.1+ds-1, 1:9.2.2+ds-1 |
| Debian:13 | qemu | 0, 0 |
| Debian:14 | qemu | 0, 0, 0 |
Timeline
- Dec 6, 2023 CVE Published
- Apr 28, 2026 CVE Updated