QubesOS发现任意代码执行漏洞 已发布安全补丁

Qubes安全团队于2026年8月28日发布QSB-118安全公告，披露QubesOS中qvm-copy-to-vm工具存在任意代码执行漏洞1。该漏洞影响所有QubesOS版本1，允许已被入侵的qube通过错误报告回传通道向Dom0注入任意命令，从而让攻击者获得系统的完整控制权1。

漏洞的根本原因在于sanitize_remote_filename()函数的不完善设计1。该函数仅移除非ASCII字符和双引号，但保留了shell元字符，而display_error()函数随后使用system()调用直接构造命令执行这些未充分清理的数据，形成注入攻击的可能1。受影响的代码位于linux-utils/qrexec-lib/pack.c和core-admin-linux/file-copy-vm/qfile-dom0-agent.c1。

发起攻击需要满足特定前置条件：用户必须从Dom0向已被入侵的qube发起qvm-copy-to-vm调用1。漏洞由Tim C.发现1。Qubes安全团队已为Qubes 4.3发布qubes-core-dom0-linux版本4.3.22补丁以修复该漏洞1。用户只需通过正常的系统更新流程即可获得安全补丁1。

The Qubes security team released security bulletin QSB-118 on August 28, 2026, disclosing a critical arbitrary code execution flaw in the qvm-copy-to-vm tool affecting all versions of QubesOS 1. The vulnerability permits a compromised qube to inject arbitrary commands into Dom0, the system's administrative domain, through the error reporting backchannel, potentially granting attackers complete control over the operating system 1.

The flaw stems from insufficient input sanitization in the sanitize_remote_filename() function, which removes only non-ASCII characters and double quotes while leaving shell metacharacters intact 1. When the display_error() function subsequently constructs a command using the system() call, this oversight enables command injection attacks 1. The vulnerable code exists in linux-utils/qrexec-lib/pack.c and core-admin-linux/file-copy-vm/qfile-dom0-agent.c 1. Exploitation requires a user to initiate a qvm-copy-to-vm call from Dom0 to an already-compromised qube 1. The flaw was discovered by Tim C. 1

The Qubes team has released patch qubes-core-dom0-linux version 4.3.22 for Qubes 4.3 to address the vulnerability 1. Users are advised to perform standard system updates to receive the security patch, with no additional action required 1.