Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
We have published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instru...
Summary
A recent security bulletin reveals a critical vulnerability in QubesOS that allows for arbitrary code execution through the qvm-copy-to-vm error reporting backchannel. The announcement includes detailed information on the issue and how to authenticate the provided signatures.
Comments (96 of ) ⌛