)]}'
{
  "commit": "f6b0de53fb87ddefed348a39284c8e2f28dc4eda",
  "tree": "ff8c37ba95f9fe4fd84bba1b225b8cb95b4c8d7a",
  "parents": [
    "45ae97993a75f975f1a01d25564724c7e10a543f"
  ],
  "author": {
    "name": "Christian Schoenebeck",
    "email": "qemu_oss@crudebyte.com",
    "time": "Wed Jun 07 18:29:33 2023 +0200"
  },
  "committer": {
    "name": "Christian Schoenebeck",
    "email": "qemu_oss@crudebyte.com",
    "time": "Thu Jun 08 17:04:58 2023 +0200"
  },
  "message": "9pfs: prevent opening special files (CVE-2023-2861)\n\nThe 9p protocol does not specifically define how server shall behave when\nclient tries to open a special file, however from security POV it does\nmake sense for 9p server to prohibit opening any special file on host side\nin general. A sane Linux 9p client for instance would never attempt to\nopen a special file on host side, it would always handle those exclusively\non its guest side. A malicious client however could potentially escape\nfrom the exported 9p tree by creating and opening a device file on host\nside.\n\nWith QEMU this could only be exploited in the following unsafe setups:\n\n  - Running QEMU binary as root AND 9p \u0027local\u0027 fs driver AND \u0027passthrough\u0027\n    security model.\n\nor\n\n  - Using 9p \u0027proxy\u0027 fs driver (which is running its helper daemon as\n    root).\n\nThese setups were already discouraged for safety reasons before,\nhowever for obvious reasons we are now tightening behaviour on this.\n\nFixes: CVE-2023-2861\nReported-by: Yanwu Shen \u003cywsPlz@gmail.com\u003e\nReported-by: Jietao Xiao \u003cshawtao1125@gmail.com\u003e\nReported-by: Jinku Li \u003cjkli@xidian.edu.cn\u003e\nReported-by: Wenbo Shen \u003cshenwenbo@zju.edu.cn\u003e\nSigned-off-by: Christian Schoenebeck \u003cqemu_oss@crudebyte.com\u003e\nReviewed-by: Greg Kurz \u003cgroug@kaod.org\u003e\nReviewed-by: Michael Tokarev \u003cmjt@tls.msk.ru\u003e\nMessage-Id: \u003cE1q6w7r-0000Q0-NM@lizzy.crudebyte.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "5cafcd770318ec1e4f0750080b5ad850eee24715",
      "old_mode": 33188,
      "old_path": "fsdev/virtfs-proxy-helper.c",
      "new_id": "d9511f429c99ae9827bd3864016fa7cfdef1889b",
      "new_mode": 33188,
      "new_path": "fsdev/virtfs-proxy-helper.c"
    },
    {
      "type": "modify",
      "old_id": "c314cf381d415f125e07b975c82efb17612e0d83",
      "old_mode": 33188,
      "old_path": "hw/9pfs/9p-util.h",
      "new_id": "df1b583a5e4b49502707a1c981438921830929db",
      "new_mode": 33188,
      "new_path": "hw/9pfs/9p-util.h"
    }
  ]
}