CVE-2022-0358: 
NixOS vulnerability analysis and mitigation

A vulnerability was discovered in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation, identified as CVE-2022-0358. This flaw is related to CVE-2018-13405 and was reported by Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang. The vulnerability was disclosed in January 2022 and affects QEMU versions prior to 6.2.0-7 (Bugzilla Report, QEMU Commit).

The vulnerability exists in the virtiofsd implementation where the daemon retains membership of existing supplementary groups after switching uid/gid using setresuid/setsgid. This retention of group membership can allow operations that should normally be restricted. The vulnerability has a CVSS score of 7.8 (HIGH) with a vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NetApp Security).

When successfully exploited, this vulnerability could lead to privilege escalation within the guest system. A malicious local user could potentially gain access to resources accessible to the root group, and a malicious local user in the host might leverage unexpected executable files created by the guest to escalate their privileges on the host system (Rapid7).

The vulnerability was patched in QEMU version 6.2.0-7 with a fix that drops membership of all supplementary groups at the start of the daemon. The patch was implemented through commit 449e8171f96a6a944d1f3b7d3627ae059eae21ca in the QEMU project. After applying the update, all QEMU virtual machines need to be restarted to implement the necessary changes (Ubuntu Security Notice, QEMU Commit).