CVE-2016-9602 : Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside

Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.

Published 2018-04-26 19:29:00

Updated 2019-10-09 23:20:39

Source Red Hat, Inc.

View at NVD, CVE.org

Threat overview for CVE-2016-9602

Top countries where our scanners detected CVE-2016-9602

Top open port discovered on systems with this issue 22

IPs affected by CVE-2016-9602 2

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2016-9602!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2016-9602

EPSS FAQ

0.21%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 59 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-9602

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
6.5	MEDIUM	AV:A/AC:H/Au:S/C:C/I:C/A:C	2.5	10.0	Red Hat, Inc.
Access Vector: Adjacent Network Access Complexity: High Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.6	HIGH	CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	1.0	6.0	Red Hat, Inc.
Attack Vector: Adjacent Network Attack Complexity: High Privileges Required: High User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-9602

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by:

nvd@nist.gov (Primary)
secalert@redhat.com (Secondary)

References for CVE-2016-9602

https://security.gentoo.org/glsa/201704-01

QEMU: Multiple vulnerabilities (GLSA 201704-01) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html

[SECURITY] [DLA 1497-1] qemu security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg06225.html

[Qemu-devel] [PATCH RFC 00/36] 9pfs: local: fix vulnerability to symlink
Mailing List;Third Party Advisory
http://www.securityfocus.com/bid/95461

QEMU CVE-2016-9602 Privilege Escalation Vulnerability
Third Party Advisory;VDB Entry
http://www.openwall.com/lists/oss-security/2017/01/17/12

oss-security - CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem
Mailing List;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9602

1413929 – (CVE-2016-9602) CVE-2016-9602 Qemu: 9p: virtfs allows guest to access host filesystem
Issue Tracking;Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04347.html

[Qemu-devel] [PATCH 00/29] 9pfs: local: fix vulnerability to symlink att
Mailing List;Third Party Advisory
http://www.securitytracker.com/id/1037604

QEMU Symbolic Link Flaw in Plan 9 FS Support Lets Local Users on a Guest System Gain Elevated Privileges on the Host System - SecurityTracker
Third Party Advisory;VDB Entry

Products affected by CVE-2016-9602