CVE-2022-0358

    Dashboard / Vulnerabilities / CVE-2022-0358

    CVE-2022-0358

    Published: 29 Aug 2022Last Modified: 12 Aug 2026

    Summary:

    Details: A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.

    References: https://access.redhat.com/security/cve/CVE-2022-0358, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0358.json, https://nvd.nist.gov/vuln/detail/CVE-2022-0358, https://security.netapp.com/advisory/ntap-20221007-0008/, https://bugzilla.redhat.com/show_bug.cgi?id=2044863, https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -449e8171f96a6a944d1f3b7d3627ae059eae21ca

    Affected versions

    v6.2.0
    v6.2.0-rc4
    v6.2.0-rc3
    v6.2.0-rc1
    v6.2.0-rc0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-0358 | CVE-DB