REDHAT-BUG-2499603: High severity Qemu qmp_guest_ssh_add_authorized_keys vulnerability
When qmpguestsshaddauthorizedkeys adds an SSH key for an existing local user, the agent (running as root) decides whether to create the user's .ssh directory with a symlink-following directory test, and then writes and chowns the authorizedkeys file using a plain chown (not lchown). A local unprivileged user who owns their home directory can pre-stage their .ssh directory (or the authorizedkeys file) as a symbolic link so that, when the host or operator triggers a key add for that user, the root agent follows the link and transfers ownership of an arbitrary root-owned file or directory to the unprivileged user, who can then rewrite it to obtain root.
Patch: https://patchew.org/QEMU/20260709105707.91209-1-kkostiuk@redhat.com/
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
QEMUto a version that resolves this vulnerability.Patch QEMU/20260709105707.91209-1-kkostiuk@redhat.com
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2499603?
The severity of REDHAT-BUG-2499603 is high with a score of 7.
How do I fix REDHAT-BUG-2499603?
To fix REDHAT-BUG-2499603, ensure that the SSH key addition process properly handles the user's .ssh directory and uses the appropriate chown method.
What is the risk level associated with REDHAT-BUG-2499603?
The risk level associated with REDHAT-BUG-2499603 is classified as 33.
What vulnerabilities does REDHAT-BUG-2499603 introduce?
REDHAT-BUG-2499603 can introduce unauthorized access due to improper handling of SSH keys and user directories.
In which software is REDHAT-BUG-2499603 found?
REDHAT-BUG-2499603 is found in the QEMU software, specifically in the qmp_guest_ssh_add_authorized_keys function.