The software (usually a web browser) accessing a hardware authentication
device (either a real one, or in this case an emulated one that forwards
requests through qrexec) must limit the requests it sends to the device.
For example, if you visit , the browser must ensure
that that site can request authentication only for
. Therefore, in the absence of an additional,
exploitable vulnerability in the browser, a malicious website cannot
exploit either of the vulnerabilities described in this QSB. However,
the intention of the CTAP proxy is (in addition to making CTAP
authentication devices usable in the first place) to restrict the access
that qubes have to authentication devices, such that even if a qube is
compromised, it cannot access credentials on the authentication device
that it has not been given permission to access. The vulnerabilities
described in this QSB affect this latter form of protection.

Note that the RPC policies themselves are correctly enforced, so these
are not vulnerabilities in qrexec. Rather, the problem lies in the CTAP
proxy's implementation of the qrexec services, which breaks the intended
semantics of the (correctly-enforced) RPC policies.

Patching
---------

The following package contains the security update that addresses the
vulnerabilities described in this bulletin:

For Qubes 4.3, in template for USB qube(s):
- qubes-ctap package, version 2.0.8

This package will migrate from the security-testing repository to the
current (stable) repository over the next two weeks after being tested
by the community. [2] Once available, the package should be installed
via the Qubes Update tool or its command-line equivalents. [1]

In order for the update to take effect, all USB qubes must be restarted
after their respective templates have been updated and shut down.

Credits
--------

Vulnerability 2 was discovered by Giulio Berra of the Freedom of the
Press Foundation.

Vulnerability 1 was discovered internally by Piotr Bartman-Szwarc during
review of the previous report.

References
-----------

[1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html
[2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html
[3] https://doc.qubes-os.org/en/r4.3/user/security-in-qubes/ctap-proxy.html
[4] https://doc.qubes-os.org/en/r4.3/user/advanced-topics/usb-qubes.html
[5] https://doc.qubes-os.org/en/r4.3/user/advanced-topics/rpc-policy.html

--
The Qubes Security Team
https://www.qubes-os.org/security/



Source: qsb-120-2026.txt (https://github.com/QubesOS/qubes-secpack/blob/4ea6603c1eb68df12868bf4c97d8efefa8d15799/QSBs/qsb-120-2026.txt)

Marek Marczykowski-Górecki (https://www.qubes-os.org/team/#marek-marczykowski-g%C3%B3recki)’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEELRdx/k12ftx2sIn61lWk8hgw4GoFAmrG7KMACgkQ1lWk8hgw
4GrgRA/+O/ej38/P71thC9CJj1vEvaKePbLFvdQhcsEsah26xUDxO9liCIdGZxnJ
yIyqPqFPoYdI6catrkgirn7/wI+oQyOYiwfK0JRezd4dLmBKf7IB0Je+3klJGFkz
j8RwzEcUzclD19L93CzT3LtBwR6MqfeNbbFdlh5zCvjVt4fbPwWWi2eYZc/NmS8L
heJhfojQzeEDaRxYBWJUAuDHt/hXDS+R4Ii5U/o3g7v8fN2CAAaUJL2Hax/c6SOX
2nosRjWaMqHjNeNZkKelCGjYhDA/MEZvwmB/jtMoFWEvQTKvon7hfvntMCEYBQRj
FfkWjNAvplfT4a2p65GgXwtNP8Arn5E1qDBUvVzswrGun3eWBRn51lhzBxCbwnlx
QeWz/vNn17brl6ctJhue21DMZ6cjdN3SP5d1MBsNQnPUeoe0TDRDPwoOpS5L4CvG
TddgeaFuleQO8bn1YE+CWu6+oC4lrymXdyRtHAoA7nqhq9WP9OZTK8SKn30g48J2
0Gvd6vk8DTsMkvycGfTpT/I5DciVPsjAa7FlRsjWkPDYHQjXbI6xlFmn+WozijpU
5hiLNT/y/Su7WHkgaFF3GxSeFnQMunaf4l11BNaJl+OmFqAJmU3Kmlm/fVDMJh0X
tUOYx1npDDkwGNXQ6CC/w0ZepLYg/GgYnlfIoBgHlSZX9o2PKwM=
=NHKR
-----END PGP SIGNATURE-----


Source: qsb-120-2026.txt.sig.marmarek (https://github.com/QubesOS/qubes-secpack/blob/4ea6603c1eb68df12868bf4c97d8efefa8d15799/QSBs/qsb-120-2026.txt.sig.marmarek)

Simon Gaiser (aka HW42) (https://www.qubes-os.org/team/#simon-gaiser-aka-hw42)’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmrG150ACgkQSsGN4REu