Qubes Security Bulletin 120 reports a critical vulnerability in Qubes OS allowing dom0 arbitrary code execution through qvm-copy-to-vm error reporting. If a user copies a file from dom0 to a compromised qube, the malicious VM can inject commands into dom0, potentially taking full control of the system.
The flaw exists in the qvm-copy-to-vm tool's filename sanitization process. When copying fails, the target VM reports errors including the filename back to dom0, which displays a GUI message using the system() function. The sanitize_remote_filename() function only removes non-ASCII characters and double quotes, leaving shell meta-characters intact, enabling command injection.
The vulnerability requires the user to initiate a qvm-copy-to-vm call from dom0 to a compromised qube. No other user action is needed for exploitation. Users should update normally to receive security patches. The VM variant of qvm-copy-to-vm is not affected, as its error reporting function differs from dom0's implementation.
Source: Hacker News · Summarized by HeadlinesBriefing