ANN: SECURITY ISSUE with Qubes shared folders

General Discussion
1

I would not ordinarily post in this forum, but I feel a responsibility towards the use of software I work on — I am the author of the software and distributor of Qubes shared folders.

Please upgrade immediately. The Qubes shared folders repo now has instructions on how to build from source; I have pushed packages to my Fedora / Qubes RPM repository that you can use if you so choose.

I have received a notification from Stefan Loewen (e-mail withheld) indicating that there is a trivial and exploitable path escape vulnerability, which allows client qubes to access any file on server qubes (that is, qubes that have mounted a share from another qube, accessing unauthorized files from the other qube).

This security issue originates in an input validation weakness (a logic bug) in the Google P9 Rust package. Qubes shared folders ships a Plan 9 file system server package which embeds the logic bug. Server qubes use this package to make available portions of their file system to other qubes, when you have authorized this. Escaping the confinement provided by the Plan 9 file system package — ergo, escaping your authorization — was not in the cards when I shipped this software.

My own fork contains their fixes plus a fix for their broken tests. The Qubes shared folders software depends on this fixed library (or, rather, a packaged-up patched version of the library, since the Google people still haven’t pushed an official version with the fix to crates.io).

I would like to apologize to every user of this software for the disruption this has caused.

(Edited to remove the text now irrelevant because the fix is available now.)

5 Likes
ANN: Qubes shared folders likely changing implementation of Plan 9 file server
2

Thank you. Please update the info in the repo as well:

4 Likes
3

Am I correct in thinking that this means that the only exploitation path is authorised client qube → whole filesystem of server qube and qubes that are not authorised at all won’t be able to exploit anything?

2 Likes
4

You are correct

2 Likes
5

The people at Google who make the p9 library (used in the file system server of Qubes shared folders) have pushed a fix (which broke a test).

I’ve taken the fix, fixed the broken test, and packaged it all up as RPMs for Fedora / Qubes, then pushed the changes to the Qubes shared folders repo, and updated the instructions on how to build from source. Version 0.5.1 contains the fix.

In other words: the fix is in, and — to my knowledge — you can safely use the software again.

5 Likes