Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu-kvmUpgrade qemu | Mar 31, 2017 | Sep 11, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Dec 4, 2019 | Dec 10, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Apr 16, 2020 | Dec 10, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 11, 2016 |
| Suse | — | Upgrade qemu-x86Upgrade qemuUpgrade kvmUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-vgabiosUpgrade qemu-toolsUpgrade qemu-sgabiosUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-cursesUpgrade qemu-kvmUpgrade qemu-armUpgrade qemu-guest-agentUpgrade qemu-seabiosUpgrade qemu-microvmUpgrade qemu-s390Upgrade qemu-ui-gtkUpgrade qemu-block-sshUpgrade qemu-s390xUpgrade qemu-audio-ossUpgrade qemu-block-curlUpgrade qemu-skibootUpgrade qemu-hw-usb-redirectUpgrade qemu-langUpgrade qemu-ppcUpgrade qemu-ui-spice-coreUpgrade qemu-audio-spiceUpgrade qemu-block-rbdUpgrade qemu-chardev-spiceUpgrade qemu-ui-openglUpgrade qemu-ksmUpgrade qemu-audio-paUpgrade qemu-ui-spice-appUpgrade qemu-block-iscsiUpgrade qemu-chardev-baumUpgrade qemu-audio-alsaUpgrade qemu-ipxe | Nov 3, 2016 | Oct 21, 2016 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-s390xUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-miscUpgrade qemu-kvmUpgrade qemu-system-arm | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub