Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel

Aug 30, 2026 03:51 PM - 2 weeks ago 5

We person published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary codification execution successful qvm-copy-to-vm correction reporting. The matter of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a wide mentation of this announcement and authentication instructions.

Qubes Security Bulletin 118

---===[ Qubes Security Bulletin 118 ]===--- 2026-08-28 Dom0 arbitrary codification execution successful qvm-copy-to-vm correction reporting User action ------------ Continue to update usually [1] successful bid to person the information updates described successful the "Patching" conception below. No different personification action is required successful consequence to this QSB. Summary -------- If `qvm-copy-to-vm` is utilized to transcript a record from dom0 to a malicious qube, that qube tin inject an arbitrary bid into dom0. Impact ------- If an attacker has compromised a qube, and if the personification initiates a `qvm-copy-to-vm` telephone from dom0 to the compromised qube, past the attacker tin utilization this vulnerability successful bid to inject an arbitrary command into dom0, which allows the attacker to return power of Qubes OS. Technical details ------------------ The `qvm-copy-to-vm` instrumentality allows copying files from dom0 to a specified qube. It uses the "qfile" protocol, which is simply a simplified archive format, including elemental record metadata (much simpler than `tar` or `cpio`). The protocol besides includes transportation confirmation astatine the end, which is sent by the target backmost to the source. This confirmation includes a checksum of each the transferred files, an correction codification (if any), and the sanction of the past received file. In the lawsuit of an error, as reported by the correction codification field, dom0 displays a GUI connection that includes the correction accusation and the sanction of the affected file, as reported by the target qube. The vulnerability exists successful the processing of that record name: 1. The `wait_for_result()` usability calls `sanitize_remote_filename()` on the received sanction earlier passing it to the correction handler: linux-utils/qrexec-lib/pack.c: 55 fixed void sanitize_remote_filename(char *untrusted_filename) 56 { 57 for (; *untrusted_filename; ++untrusted_filename) { 58 if (*untrusted_filename < ' ' || 59 *untrusted_filename > '~' || 60 *untrusted_filename == '"') 61 *untrusted_filename = '_'; 62 } 63 } 64 65 void wait_for_result(void) 66 { ... 98 /* sanitize the distant filename */ 99 sanitize_remote_filename(last_filename); 100 101 errno = hdr.error_code; 102 if (hdr.error_code != 0) { 103 move (hdr.error_code) { 104 lawsuit EEXIST: 105 call_error_handler("A record named \"%s\" already exists successful QubesIncoming dir", last_filename); 106 break; ... 2. Then, `call_error_handler()` calls the dom0 version of the error reporting usability -- `gui_fatal()` -> `display_error()`, which uses `system()` to motorboat the existent correction dialog: core-admin-linux/file-copy-vm/qfile-dom0-agent.c: 15 void display_error(const char *fmt, va_list args) { 16 char *dialog_cmd; 17 char buf[1024]; 18 struct stat st_buf; 19 int ret; 20 21 (void) vsnprintf(buf, sizeof(buf), fmt, args); 22 ret = stat("/usr/bin/kdialog", &st_buf); 23 #define KDIALOG_CMD "kdialog --title 'File copy/move error' --sorry " 24 #define ZENITY_CMD "zenity --title 'File copy/move error' --warning --text " 25 if (asprintf(&dialog_cmd, "%s '%s: %s (error type: %s)'", 26 ret==0 ? KDIALOG_CMD : ZENITY_CMD, 27 program_invocation_short_name, buf, strerror(errno)) < 0) { 28 fprintf(stderr, "Failed to allocate representation for correction connection :(\n"); 29 return; 30 } 31 #undef KDIALOG_CMD 32 #undef ZENITY_CMD 33 fprintf(stderr, "%s\n", buf); 34 system(dialog_cmd); 35 } 36 37 _Noreturn void gui_fatal(const char *fmt, ...) { 38 va_list args; 39 va_start(args, fmt); 40 display_error(fmt, args); 41 va_end(args); 42 exit(1); 43 } The problem is that `sanitize_remote_filename()` removes only non-ASCII characters (and double quotation marks) but leaves ammunition meta-characters in place. Then, `system()` runs the constructed command, including the attacker-controlled sanction via the shell. Note that the VM version of `qvm-copy-to-vm` is not affected, arsenic its version of the correction reporting usability does not usage `system()`: core-agent-linux/qubes-rpc/gui-fatal.c: 16 fixed void produce_message(const char *type, const char *fmt, va_list args) 17 { ... 31 if (progress_type && !strcmp(progress_type, "gui")) 32 { 33 move (fork()) 34 { 35 lawsuit -1: 36 exit(1); // what else 37 lawsuit 0: 38 if (geteuid() == 0) { 39 if (setuid(getuid()) != 0) { 40 perror("setuid failed, not calling zenity/kdialog"); 41 exit(1); 42 } 43 } 44 fix_display(); 45 execlp("/usr/bin/zenity", "zenity", "--error", "--text", dialog_msg, NULL); 46 execlp("/usr/bin/kdialog", "kdialog", "--sorry", dialog_msg, NULL); 47 exit(1); 48 default:; 49 } 50 } 51 free(dialog_msg); 52 } 53 54 void gui_fatal(const char *fmt, ...) 55 { 56 va_list args; 57 va_start(args, fmt); 58 produce_message("Fatal error", fmt, args); 59 va_end(args); 60 exit(1); 61 } Affected systems ----------------- All Qubes OS releases are affected. Patching --------- The pursuing package contains the information update that addresses the vulnerability described successful this bulletin: For Qubes 4.3, successful dom0: - qubes-core-dom0-linux, type 4.3.22 This package will migrate from the security-testing repository to the current (stable) repository aft a short play of testing by the community. [2] Once available, the package should beryllium installed via the Qubes Update instrumentality aliases its command-line equivalents. [1] Credits -------- The vulnerability was discovered by Tim C. References ----------- [1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html -- The Qubes Security Team https://www.qubes-os.org/security/

Source: qsb-118-2026.txt

Marek Marczykowski-Górecki’s PGP signature

Source: qsb-118-2026.txt.sig.marmarek

Simon Gaiser (aka HW42)’s PGP signature

Source: qsb-118-2026.txt.sig.simon

What is the intent of this announcement?

The intent of this announcement is to pass the Qubes organization that a caller Qubes information bulletin (QSB) has been published.

What is simply a Qubes information bulletin (QSB)?

A Qubes information bulletin (QSB) is simply a information announcement issued by the Qubes information team. A QSB typically provides a summary and effect study of 1 aliases much recently-discovered package vulnerabilities, including specifications astir patching to reside them.

Why should I attraction astir QSBs?

QSBs show you what actions you must return successful bid to protect yourself from recently-discovered information vulnerabilities. In astir cases, information vulnerabilities are addressed by updating normally. However, successful immoderate cases, typical personification action is required. In each cases, the required actions are elaborate successful QSBs.

What are the PGP signatures that travel QSBs?

A PGP signature is simply a cryptographic digital signature made successful accordance pinch the OpenPGP standard. PGP signatures tin beryllium cryptographically verified pinch programs for illustration GNU Privacy Guard (GPG). The Qubes information squad cryptographically signs each QSBs truthful that Qubes users person a reliable measurement to cheque whether QSBs are genuine. The only measurement to beryllium definite that a QSB is authentic is by verifying its PGP signatures.

Why should I attraction whether a QSB is authentic?

A forged QSB could deceive you into taking actions that adversely impact the information of your Qubes OS system, specified arsenic installing malware aliases making configuration changes that render your strategy susceptible to attack. Falsified QSBs could sow fear, uncertainty, and uncertainty astir the information of Qubes OS aliases the position of the Qubes OS Project.

How do I verify the PGP signatures connected a QSB?

The pursuing command-line instructions presume a Linux strategy pinch git and gpg installed. (For Windows and Mac options, spot OpenPGP software.)

Obtain the Qubes Master Signing Key (QMSK), e.g.:

$ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc gpg: directory '/home/user/.gnupg' created gpg: keybox '/home/user/.gnupg/pubring.kbx' created gpg: requesting cardinal from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc' gpg: /home/user/.gnupg/trustdb.gpg: trustdb created gpg: cardinal DDFA1A3E36879494: nationalist cardinal "Qubes Master Signing Key" imported gpg: Total number processed: 1 gpg: imported: 1

(For much ways to get the QMSK, spot How to import and authenticate the Qubes Master Signing Key.)
View the fingerprint of the PGP cardinal you conscionable imported. (Note: gpg> indicates a punctual wrong of the GnuPG program. Type what appears aft it erstwhile prompted.)

$ gpg --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494 gpg (GnuPG) 2.2.27; Copyright (C) 2021Software Foundation, Inc. This is free software: you are free to alteration and redistribute it. There is NO WARRANTY, to the grade permitted by law. pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: ne'er usage: SC trust: chartless validity: unknown [ unknown] (1). Qubes Master Signing Key gpg> fpr pub rsa4096/DDFA1A3E36879494 2010-04-01 Qubes Master Signing Key Primary cardinal fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494
Important: At this point, you still don’t cognize whether the cardinal you conscionable imported is the genuine QMSK aliases a forgery. In bid for this full process to supply meaningful information benefits, you must authenticate the QMSK out-of-band. Do not skip this step! The modular method is to get the QMSK fingerprint from multiple independent sources successful respective different ways and cheque to spot whether they lucifer the cardinal you conscionable imported. For much information, spot How to import and authenticate the Qubes Master Signing Key.

Tip: After you person authenticated the QMSK out-of-band to your satisfaction, grounds the QMSK fingerprint successful a safe spot (or several) truthful that you don’t person to repetition this measurement successful the future.
Once you are satisfied that you person the genuine QMSK, group its spot level to 5 (“ultimate”), past discontinue GnuPG pinch q.

gpg> trust pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: ne'er usage: SC trust: chartless validity: unknown [ unknown] (1). Qubes Master Signing Key Please determine really acold you spot this personification to correctly verify different users' keys (by looking astatine passports, checking fingerprints from different sources, etc.) 1 = I don't cognize aliases won't say 2 = I do NOT trust 3 = I spot marginally 4 = I spot fully 5 = I spot ultimately m = backmost to the main menu Your decision? 5 Do you really want to group this cardinal to eventual trust? (y/N) y pub rsa4096/DDFA1A3E36879494 created: 2010-04-01 expires: ne'er usage: SC trust: eventual validity: unknown [ unknown] (1). Qubes Master Signing Key Please statement that the shown cardinal validity is not needfully correct unless you restart the program. gpg> q
Use Git to clone the qubes-secpack repo.

$ git clone https://github.com/QubesOS/qubes-secpack.git Cloning into 'qubes-secpack'... remote: Enumerating objects: 4065, done. remote: Counting objects: 100% (1474/1474), done. remote: Compressing objects: 100% (742/742), done. remote: Total 4065 (delta 743), reused 1413 (delta 731), pack-reused 2591 Receiving objects: 100% (4065/4065), 1.64 MiB | 2.53 MiB/s, done. Resolving deltas: 100% (1910/1910), done.
Import the included PGP keys. (See our PGP cardinal policies for important accusation astir these keys.)

$ gpg --import qubes-secpack/keys/*/* gpg: cardinal 063938BA42CFA724: nationalist cardinal "Marek Marczykowski-Górecki (Qubes OS signing key)" imported gpg: qubes-secpack/keys/core-devs/retired: publication error: Is a directory gpg: nary valid OpenPGP information found. gpg: cardinal 8C05216CE09C093C: 1 signature not checked owed to a missing key gpg: cardinal 8C05216CE09C093C: nationalist cardinal "HW42 (Qubes Signing Key)" imported gpg: cardinal DA0434BC706E1FCF: nationalist cardinal "Simon Gaiser (Qubes OS signing key)" imported gpg: cardinal 8CE137352A019A17: 2 signatures not checked owed to missing keys gpg: cardinal 8CE137352A019A17: nationalist cardinal "Andrew David Wong (Qubes Documentation Signing Key)" imported gpg: cardinal AAA743B42FBC07A9: nationalist cardinal "Brennan Novak (Qubes Website & Documentation Signing)" imported gpg: cardinal B6A0BB95CA74A5C3: nationalist cardinal "Joanna Rutkowska (Qubes Documentation Signing Key)" imported gpg: cardinal F32894BE9684938A: nationalist cardinal "Marek Marczykowski-Górecki (Qubes Documentation Signing Key)" imported gpg: cardinal 6E7A27B909DAFB92: nationalist cardinal "Hakisho Nukama (Qubes Documentation Signing Key)" imported gpg: cardinal 485C7504F27D0A72: 1 signature not checked owed to a missing key gpg: cardinal 485C7504F27D0A72: nationalist cardinal "Sven Semmler (Qubes Documentation Signing Key)" imported gpg: cardinal BB52274595B71262: nationalist cardinal "unman (Qubes Documentation Signing Key)" imported gpg: cardinal DC2F3678D272F2A8: 1 signature not checked owed to a missing key gpg: cardinal DC2F3678D272F2A8: nationalist cardinal "Wojtek Porczyk (Qubes OS archiving signing key)" imported gpg: cardinal FD64F4F9E9720C4D: 1 signature not checked owed to a missing key gpg: cardinal FD64F4F9E9720C4D: nationalist cardinal "Zrubi (Qubes Documentation Signing Key)" imported gpg: cardinal DDFA1A3E36879494: "Qubes Master Signing Key" not changed gpg: cardinal 1848792F9E2795E9: nationalist cardinal "Qubes OS Release 4 Signing Key" imported gpg: qubes-secpack/keys/release-keys/retired: publication error: Is a directory gpg: nary valid OpenPGP information found. gpg: cardinal D655A4F21830E06A: nationalist cardinal "Marek Marczykowski-Górecki (Qubes information pack)" imported gpg: cardinal ACC2602F3F48CB21: nationalist cardinal "Qubes OS Security Team" imported gpg: qubes-secpack/keys/security-team/retired: publication error: Is a directory gpg: nary valid OpenPGP information found. gpg: cardinal 4AC18DE1112E1490: nationalist cardinal "Simon Gaiser (Qubes Security Pack signing key)" imported gpg: Total number processed: 17 gpg: imported: 16 gpg: unchanged: 1 gpg: marginals needed: 3 completes needed: 1 spot model: pgp gpg: depth: 0 valid: 1 signed: 6 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 6 signed: 0 trust: 6-, 0q, 0n, 0m, 0f, 0u
Verify signed Git tags.

$ cd qubes-secpack/ $ git tag -v `git describe` object 266e14a6fae57c9a91362c9ac784d3a891f4d351 type commit tag marmarek_sec_266e14a6 tagger Marek Marczykowski-Górecki 1677757924 +0100 Tag for perpetrate 266e14a6fae57c9a91362c9ac784d3a891f4d351 gpg: Signature made Thu 02 Mar 2023 03:52:04 AM PST gpg: utilizing RSA cardinal 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes information pack)" [full]

The nonstop output will differ, but the last statement should ever commencement pinch gpg: Good signature from... followed by an due key. The [full] indicates afloat trust, which this cardinal inherits successful kindness of being validly signed by the QMSK.
Verify PGP signatures, e.g.:

$ cd QSBs/ $ gpg --verify qsb-087-2022.txt.sig.marmarek qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 04:05:51 AM PST gpg: utilizing RSA cardinal 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes information pack)" [full] $ gpg --verify qsb-087-2022.txt.sig.simon qsb-087-2022.txt gpg: Signature made Wed 23 Nov 2022 03:50:42 AM PST gpg: utilizing RSA cardinal EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full] $ cd ../canaries/ $ gpg --verify canary-034-2023.txt.sig.marmarek canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 03:51:48 AM PST gpg: utilizing RSA cardinal 2D1771FE4D767EDC76B089FAD655A4F21830E06A gpg: Good signature from "Marek Marczykowski-Górecki (Qubes information pack)" [full] $ gpg --verify canary-034-2023.txt.sig.simon canary-034-2023.txt gpg: Signature made Thu 02 Mar 2023 01:47:52 AM PST gpg: utilizing RSA cardinal EA18E7F040C41DDAEFE9AA0F4AC18DE1112E1490 gpg: Good signature from "Simon Gaiser (Qubes Security Pack signing key)" [full]

Again, the nonstop output will differ, but the last statement of output from each gpg --verify bid should ever commencement pinch gpg: Good signature from... followed by an due key.

For this announcement (QSB-118), the commands are:

$ gpg --verify qsb-118-2026.txt.sig.marmarek qsb-118-2026.txt $ gpg --verify qsb-118-2026.txt.sig.simon qsb-118-2026.txt

You tin besides verify the signatures straight from this announcement successful summation to aliases alternatively of verifying the files from the qubes-secpack. Simply transcript and paste the QSB-118 matter into a plain matter record and do the aforesaid for some signature files. Then, execute the aforesaid authentication steps arsenic listed above, substituting the filenames supra pinch the names of the files you conscionable created.