[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[PATCH v3 0/2] QGA installer fixes

From: Konstantin Kostiuk
Subject: [PATCH v3 0/2] QGA installer fixes
Date: Fri, 3 Mar 2023 21:20:06 +0200

resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2167423
fixes: CVE-2023-0664 (2 parts)

CVE Technical details: The cached installer for QEMU Guest Agent in 
can be leveraged to begin a repair of the installation without validation
that the repair is being performed by an administrative user. The MSI repair
custom action "RegisterCom" and "UnregisterCom" is not set for impersonation
which allows for the actions to occur as the SYSTEM account
(LINE 137 AND 145 of qemu-ga.wxs). The custom action also leverages cmd.exe
to run qemu-ga.exe in line 134 and 142 which causes an interactive command
shell to spawn even though the MSI is set to be non-interactive on line 53.

Reported-by: Brian Wiltse <brian.wiltse@live.com>

v2: https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg05979.html
v2 -> v3:
  Minor fix in commit messages

v1: https://lists.nongnu.org/archive/html/qemu-devel/2023-02/msg05661.html
v1 -> v2:
  Add explanation into commit messages

Konstantin Kostiuk (2):
  qga/win32: Remove change action from MSI installer
  qga/win32: Use rundll for VSS installation

 qga/installer/qemu-ga.wxs | 11 ++++++-----
 qga/vss-win32/install.cpp |  9 +++++++++
 qga/vss-win32/qga-vss.def |  2 ++
 3 files changed, 17 insertions(+), 5 deletions(-)


reply via email to

[Prev in Thread] Current Thread [Next in Thread]