medium 6.0

CVE-2023-2861 json

Qemu: 9pfs: improper access control on special files

published 2023-12-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-34310

cvss: 6.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits: 0; none known

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.

Patch / fix

fixed in 1 distros 6 links 1

qemu qemu 8.1.0

debian ubuntu suse opensuse alpine azure linux

qemu Debian 12 1:7.2+dfsg-7+deb12u1
qemu Debian 14, Debian 13 1:8.0.3+dfsg-1

debian advisories DEBIAN-CVE-2023-2861

qemu Ubuntu 20.04 LTS 1:4.2-3ubuntu6.28
qemu Ubuntu 22.04 LTS 1:6.2+dfsg-2ubuntu6.16
qemu Ubuntu Pro 14.04 LTS 2.0.0+dfsg-2ubuntu1.47+esm6
qemu Ubuntu Pro 16.04 LTS 1:2.5+dfsg-5ubuntu10.51+esm4
qemu Ubuntu Pro 18.04 LTS 1:2.11+dfsg-1ubuntu7.42+esm5
kvmtool Ubuntu Pro 16.04 LTS 0.20151104-1ubuntu0.1~esm1
kvmtool Ubuntu Pro 18.04 LTS 0.20170904-1ubuntu0.18.04.1~esm1
kvmtool Ubuntu Pro 20.04 LTS 0.20170904-1ubuntu0.20.04.1~esm1

ubuntu advisories UBUNTU-CVE-2023-2861

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

qemu SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Micro 5.2 +3 more 5.2.0-150300.130.1
qemu SLE Module for Server Applications 15 SP5, SLE Module for Basesystem 15 SP5, SLE Micro 5.5 +1 more 7.1.0-150500.49.6.1
qemu SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLE High Performance Computing 15 SP2-LTSS +1 more 4.2.1-150200.79.1
qemu SLE Module for Server Applications 15 SP4, SLE Module for Basesystem 15 SP4, SLE Micro 5.4 +4 more 6.2.0-150400.37.20.1
qemu SLES for SAP 12 SP5, SLES 12 SP5 3.1.1.1-69.1
qemu SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLE High Performance Computing 15 SP1-LTSS 3.1.1.1-150100.80.51.5

suse advisories SUSE-SU-2024:2977-1 SUSE-SU-2023:3082-2 SUSE-SU-2023:3800-1 SUSE-SU-2023:3721-1 SUSE-SU-2023:3234-1 SUSE-SU-2023:3082-1

qemu openSUSE Tumbleweed 8.0.3-1.1

opensuse advisories openSUSE-SU-2024:13058-1

qemu Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 8.0.2-r1

alpine advisories ALPINE-CVE-2023-2861

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

qemu CBL-Mariner 2.0 6.2.0-23
qemu Azure Linux 3.0 8.2.0-1

azure linux advisories AZL-32127 AZL-35167

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

bugzilla.redhat.com/show_bug.cgi?id=2219266 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-2861 updated 2026-11-07 cvss 6.0

QEMU: 9pfs: improper access control on special files

Red Hat Enterprise Linux 6 qemu-img, qemu-kvm, qemu-kvm-tools, qemu-guest-agent, qemu-guest-agent-win32 Red Hat Enterprise Linux 7 qemu-img, qemu-kvm, libcacard, qemu-img-ma, qemu-kvm-ma, qemu-kvm-tools, +5 more Red Hat Enterprise Linux 8 qemu-img, qemu-kvm, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, qemu-guest-agent, +8 more Red Hat Enterprise Linux 8 Advanced Virtualization qemu-img, qemu-kvm, qemu-kiwi, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, +9 more Red Hat Enterprise Linux 9 qemu-img, qemu-kvm, qemu-kvm-core, qemu-kvm-tools, qemu-pr-helper, qemu-kvm-common, +16 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-24-046-11 updated 2024-02-13 cvss 7.1

Siemens SCALANCE XCM-/XRM-300

Siemens SCALANCE XCH328 (6GK5328-4TS01-2EC2) <V2.4 Siemens SCALANCE XCM324 (6GK5324-8TS01-2AC2) <V2.4 Siemens SCALANCE XCM328 (6GK5328-4TS01-2AC2) <V2.4 Siemens SCALANCE XCM332 (6GK5332-0GA01-2AC2) <V2.4 Siemens SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) <V2.4 Siemens SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) <V2.4

+5 more productsfewer

Siemens SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) <V2.4 Siemens SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) <V2.4

affected: fixed in V2.4 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-01-24)

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.0	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
NVD	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

qemu qemu

Classification

Weakness

CWE-284 Improper Access Control

References

bugzilla.redhat.com /show_bug.cgi?id=2219266
issue-tracking, patch
access.redhat.com /security/cve/CVE-2023-2861
vdb-entry, vendor-advisory
lists.debian.org /debian-lts-announce/2024/03/msg00012.html
security.netapp.com /advisory/ntap-20240125-0005/
security.netapp.com /advisory/ntap-20240229-0002/

Sources

CVE List CVE-2023-2861
NVD CVE-2023-2861

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary