Security Advisory: QSB-118 — Dom0 Remote Code Execution via qvm-copy-to-vm

Date: 2026-08-28
Bulletin ID: QSB-118
Category: Security / Dom0 Arbitrary Code Execution

---

📌 Executive Summary

A critical vulnerability has been identified in the qvm-copy-to-vm utility. If a user attempts to transfer a file from dom0 to a compromised or malicious qube, that qube can leverage the error-reporting mechanism to execute arbitrary commands within dom0.

Impact Assessment

Warning: This vulnerability allows an attacker who has already compromised a qube to "escape" that VM and gain total control over the entire OS by targeting the dom0 administrator.

---

🛠 Technical Deep Dive

The "qfile" Protocol

The qvm-copy-to-vm tool utilizes a streamlined archive format known as the qfile protocol. This protocol handles file metadata more simply than standard tools like cpio or tar.

Crucially, the protocol requires a transfer confirmation sent from the destination VM back to the source (dom0). This confirmation packet contains:

1. A checksum of the transferred data.
2. An error code (if the transfer failed).
3. The name of the final file received.

The Vulnerability Path

When an error occurs, dom0 triggers a GUI notification to inform the user. The flaw lies in how dom0 processes the filename provided by the untrusted VM.

1. Insufficient Sanitization

The function sanitize_remote_filename() is intended to clean the input, but it is fundamentally flawed. It only targets non-ASCII characters and double quotes:

/* linux-utils/qrexec-lib/pack.c */
static void sanitize_remote_filename(char *untrusted_filename) {
    for (; *untrusted_filename; ++untrusted_filename) {
        if (*untrusted_filename < 32 || // Non-printable/non-ASCII
            *untrusted_filename == '~' || 
            *untrusted_filename == '"') 
            *untrusted_filename = '_';
    }
}

2. Shell Injection via system()

After this weak sanitization, the filename is passed to call_error_handler(), which eventually invokes display_error(). This function constructs a shell command string and executes it using system():

/* core-admin-linux/file-copy-vm/qfile-dom0-agent.c */
// ...
#define KDIALOG_CMD "kdialog --title 'File copy/move error' --sorry "
#define ZENITY_CMD "zenity --title 'File copy/move error' --warning --text "

if (asprintf(dialog_cmd, "%s '%s: %s (error type: %s)'", 
             ret==0 ? KDIALOG_CMD : ZENITY_CMD, 
             program_invocation_short_name, buf, strerror(errno)) 0) {
    // ...
}
system(dialog_cmd); // <--- VULNERABILITY: Shell execution of untrusted input

Because shell meta-characters (like ;, &, or `) are not removed by the sanitizer, an attacker can craft a filename that "breaks out" of the intended command and executes arbitrary code.

Logic Flow Diagram

Why the VM variant is safe

Interestingly, the version of qvm-copy-to-vm running inside a VM is not vulnerable. It uses execlp() instead of system(), which bypasses the shell entirely:

/* core-agent-linux/qubes-rpc/gui-fatal.c */
// ...
execlp("/usr/bin/zenity", "zenity", "--error", "--text", dialog_msg, NULL);
execlp("/usr/bin/kdialog", "kdialog", "--sorry", dialog_msg, NULL);

Mathematically, the risk can be represented as: $\text{Risk} = (\text{Untrusted Input}) \times (\text{Weak Sanitization}) \times (\text{Shell Interpreter})$ In the VM variant, the $\text{Shell Interpreter}$ term is $0$, nullifying the risk.

---

🛡 Remediation and Patching

All Qubes OS releases are affected. Users are urged to update their systems immediately.

Update Requirements

For users on Qubes 4.3, the following package in dom0 must be updated:

• Package: qubes-core-dom0-linux
• Version: 4.3.22

Action Plan

• Open the Qubes Update tool.
• Check for available updates in the security-testing or stable repositories.
• Install the updated qubes-core-dom0-linux package.
• Reboot if necessary to ensure all services are using the patched library.

---

📝 Additional Information

Credits: This security flaw was discovered and reported by Tim C.

References:

• Official Update Guide
• Testing Repository Information

Sign-off: The Qubes Security Team
https://www.qubes-os.org/security/