Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel

通过 copy-to-vm 错误报告反向通道在 QubesOS 中执行任意代码

We have published Qubes Security Bulletin (QSB) 118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting. The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. 我们已发布 Qubes 安全公告 (QSB) 118：qvm-copy-to-vm 错误报告中存在的 Dom0 任意代码执行漏洞。该 QSB 的正文及其附带的加密签名转载如下，随后是关于此公告的通用说明及验证指南。

Qubes Security Bulletin 118

Qubes 安全公告 118

2026-08-28 Dom0 arbitrary code execution in qvm-copy-to-vm error reporting 2026-08-28 qvm-copy-to-vm 错误报告中的 Dom0 任意代码执行漏洞

User action 用户操作

Continue to update normally [1] in order to receive the security updates described in the “Patching” section below. No other user action is required in response to this QSB. 请继续正常更新系统 [1]，以获取下文“补丁”部分所述的安全更新。针对此 QSB，无需进行其他任何用户操作。

Summary 摘要

If qvm-copy-to-vm is used to copy a file from dom0 to a malicious qube, that qube can inject an arbitrary command into dom0. 如果使用 qvm-copy-to-vm 将文件从 dom0 复制到恶意 qube，该 qube 可以向 dom0 注入任意命令。

Impact 影响

If an attacker has compromised a qube, and if the user initiates a qvm-copy-to-vm call from dom0 to the compromised qube, then the attacker can exploit this vulnerability in order to inject an arbitrary command into dom0, which allows the attacker to take control of Qubes OS. 如果攻击者已经入侵了一个 qube，且用户从 dom0 发起了一个指向该受损 qube 的 qvm-copy-to-vm 调用，那么攻击者可以利用此漏洞向 dom0 注入任意命令，从而控制 Qubes OS。

Technical details 技术细节

The qvm-copy-to-vm tool allows copying files from dom0 to a specified qube. It uses the “qfile” protocol, which is a simplified archive format, including simple file metadata (much simpler than tar or cpio). The protocol also includes transfer confirmation at the end, which is sent by the target back to the source. This confirmation includes a checksum of all the transferred files, an error code (if any), and the name of the last received file. In the case of an error, as reported by the error code field, dom0 displays a GUI message that includes the error information and the name of the affected file, as reported by the target qube. qvm-copy-to-vm 工具允许将文件从 dom0 复制到指定的 qube。它使用“qfile”协议，这是一种简化的归档格式，包含简单的文件元数据（比 tar 或 cpio 简单得多）。该协议还在末尾包含传输确认，由目标端发送回源端。此确认信息包含所有传输文件的校验和、错误代码（如有）以及最后接收到的文件名。如果错误代码字段报告了错误，dom0 会显示一个 GUI 消息，其中包含由目标 qube 报告的错误信息和受影响文件的名称。

The vulnerability exists in the processing of that file name: 该漏洞存在于对文件名的处理过程中：

1. The wait_for_result() function calls sanitize_remote_filename() on the received name before passing it to the error handler.

2. wait_for_result() 函数在将接收到的文件名传递给错误处理程序之前，会对其调用 sanitize_remote_filename()。

3. Then, call_error_handler() calls the dom0 variant of the error reporting function — gui_fatal() -> display_error(), which uses system() to launch the actual error dialog.

4. 随后，call_error_handler() 会调用错误报告函数的 dom0 变体——gui_fatal() -> display_error()，该函数使用 system() 来启动实际的错误对话框。

The problem is that sanitize_remote_filename() removes only non-ASCII characters (and double quotation marks) but leaves shell meta-characters in place. Then, system() runs the constructed command, including the attacker-controlled name via the shell. 问题在于 sanitize_remote_filename() 仅移除了非 ASCII 字符（和双引号），但保留了 shell 元字符。随后，system() 通过 shell 运行构建好的命令，其中包含了攻击者控制的文件名。

Note that the VM variant of qvm-copy-to-vm is not affected, as its version of the error reporting function does not use system(). 请注意，qvm-copy-to-vm 的 VM 变体不受影响，因为其错误报告函数版本不使用 system()。

Affected systems 受影响的系统

All Qubes OS releases are affected. 所有 Qubes OS 版本均受影响。

Patching 补丁

The following package contains the security update that addresses the vulnerability described in this bulletin: 以下软件包包含修复本公告所述漏洞的安全更新：

For Qubes 4.3, in dom0:

• qubes-core-dom0-linux, version 4.3.22 针对 Qubes 4.3，在 dom0 中：
• qubes-core-dom0-linux，版本 4.3.22

This package will migrate from the security-testing repository to the current (stable) repository after a short period of testing by the community. Once available, the package should be installed via the Qubes Update tool or its command-line equivalents. 在经过社区的一段测试后，该软件包将从 security-testing 存储库迁移到当前（稳定）存储库。一旦可用，应通过 Qubes 更新工具或其命令行等效工具进行安装。

Credits 致谢

The vulnerability was discovered by Tim C. 该漏洞由 Tim C. 发现。

References 参考资料

[1] https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html [2] https://doc.qubes-os.org/en/latest/user/downloading-installing-upgrading/testing.html

— The Qubes Security Team https://www.qubes-os.org/security/ Qubes 安全团队 https://www.qubes-os.org/security/