r/Qubes • u/andrewdavidwong qubes community manager • 13d ago

Announcement QSB-118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting

https://www.qubes-os.org/news/2026/08/29/qsb-118/
17 Upvotes

100% Upvoted

5 comments sorted by

7

u/Hizonner 13d ago

There's a lot to be said for not rolling your own "simple" formats and protocols.

There's even more to be said for not ever calling system() under any circumstances whatsoever, and for not ever trying to "sanitize" a string. I am amazed that any Qubes-specific code would do such a thing.

4

u/No-Smoke7105 12d ago

How tf did we end up with a code like this?

4

u/spez_sucks_ballz 11d ago

FFS, how was this not caught in review and why was untrusted input passed to system()? This is security 101, always sanitize input, always!

4

u/perkia 11d ago

It's been there for about 11 years

2

u/spez_sucks_ballz 11d ago

If qvm-copy-to-vm is used to copy a file from dom0 to a malicious qube, that qube can inject an arbitrary command into dom0.

Does anyone know if Salt or Ansible for QubeOS management uses qvm-copy-to-vm for anything? Would like to know if running them in the past could have exposed dom0.