27 program_invocation_short_name, buf, strerror(errno)) < 0) {
28 fprintf(stderr, "Failed to allocate memory for error message :(\n");
29 return;
30 }
31 #undef KDIALOG_CMD
32 #undef ZENITY_CMD
33 fprintf(stderr, "%s\n", buf);
34 system(dialog_cmd);
35 }
36
37 _Noreturn void gui_fatal(const char *fmt, ...) {
38 va_list args;
39 va_start(args, fmt);
40 display_error(fmt, args);
41 va_end(args);
42 exit(1);
43 }

The problem is that `sanitize_remote_filename()` removes only non-ASCII
characters (and double quotation marks) but leaves shell meta-characters
in place. Then, `system()` runs the constructed command, including the
attacker-controlled name via the shell.

Note that the VM variant of `qvm-copy-to-vm` is not affected, as its
version of the error reporting function does not use `system()`:

core-agent-linux/qubes-rpc/gui-fatal.c:

16 static void produce_message(const char *type, const char *fmt, va_list args)
17 {
...
31 if (progress_type && !strcmp(progress_type, "gui"))
32 {
33 switch (fork())
34 {
35 case -1:
36 exit(1); // what else
37 case 0:
38 if (geteuid() == 0) {
39 if (setuid(getuid()) != 0) {
40 perror("setuid failed, not calling zenity/kdialog");
41 exit(1);
42 }
43 }
44 fix_display();
45 execlp("/usr/bin/zenity", "zenity", "--error", "--text", dialog_msg, NULL);
46 execlp("/usr/bin/kdialog", "kdialog", "--sorry", dialog_msg, NULL);
47 exit(1);
48 default:;
49 }
50 }
51 free(dialog_msg);
52 }
53
54 void gui_fatal(const char *fmt, ...)
55 {
56 va_list args;
57 va_start(args, fmt);
58 produce_message("Fatal error", fmt, args);
59 va_end(args);
60 exit(1);
61 }

Affected systems
-----------------

All Qubes OS releases are affected.

Patching
---------

The following package contains the security update that addresses the
vulnerability described in this bulletin:

For Qubes 4.3, in dom0:
- qubes-core-dom0-linux, version 4.3.22

This package will migrate from the security-testing repository to the
current (stable) repository after a short period of testing by the
community. [2] Once available, the package should be installed via the
Qubes Update tool or its command-line equivalents. [1]

Credits
--------

The vulnerability was discovered by Tim C.

References
-----------

[1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html
[2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html

--
The Qubes Security Team
https://www.qubes-os.org/security/



Source: qsb-118-2026.txt (https://github.com/QubesOS/qubes-secpack/blob/f65082c8211a421ed15a59219d6e54e93289fafb/QSBs/qsb-118-2026.txt)

Marek Marczykowski-Górecki (https://www.qubes-os.org/team/#marek-marczykowski-g%C3%B3recki)’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmqSIHAACgkQ1lWk8hgw
4GoFoQ/+PavdhVipF8/C2uLvBrYcdUmPA8FraC89p4DLzAoh2EUOerSjzPSqyTwJ
S50jPNVHYiP6GaHsHoBNuRd8S9IN1GhyHfSRabjgcV/TfhXLXk8LrPVegq2IRMY6
FzkbBdpIUNn0gILeBJXyDhF50weRvrg7SZuwmjYvKUPHb4mA6wHEw01cuj54wVYW
iL/byB7ULnvlQWnsvKSYmSM3u+b9gOz2+jinNh2qRNg3pP3MUv1gQMFKH9CN5wE1
BiPn1bIn5v9V5RcG4nB6qgtqSE1JgB5a9KYJ3gNhGKA0N3Mnf+wS3LfWeU+0xmjW
PtWjMF+d1ZppT3yEeQj1jyyAemmwkB5zl+c/6FcEX8zvWGO2aYT/xe5yTbW7kVsM
js+FiF4opVMRx3t85WfbkN6Pu0F/bNP0OsE2IJ2G7T6v9gfzb4RfuLYdb01p9Mw2
RBZVP+tcQb7gtXdysapkLsIO+ST8AcewocokiPF3st+QeB6v/3pl+aab2NojXoUk
UzoJvRRd3e/KtAV1k1EAtajG5O8HFerW9LaULOGs6nPbVDBRLhJp0nlec5ZuRbpX