Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
Points and comments are a snapshot, not live.
QubesOS QSB-118: a compromised qube can inject commands into dom0 via qvm-copy-to-vm error handling.
If a user copies a file from dom0 to a compromised qube via qvm-copy-to-vm, the qube can inject arbitrary shell commands into dom0. The vulnerability is in the error-reporting backchannel: the `sanitize_remote_filename()` function strips only non-ASCII and double-quote characters, leaving shell metacharacters. These are passed to `system()` in dom0's `display_error()`. The VM-to-VM variant is not affected. All Qubes releases are affected; the patch is qubes-core-dom0-linux 4.3.22.
What commenters are saying
Commenters widely see this as a textbook example of why `system()` is dangerous. Some note the attack surface is limited because it requires a copy from dom0, which is discouraged, but others counter that common tasks (e.g., moving screenshots from dom0 to a qube) trigger it. A few point out the sanitization is sloppy: it checks `kdialog` via full path but then relies on the shell's PATH. There is general praise for Qubes' security track record and thorough bulletin format.