CyberRota Analysis
AI-GeneratedQubes OS versions prior to 4.3.22 are vulnerable to OS command injection during the `qvm-copy-to-vm` operation from dom0 to a compromised qube, due to improper handling of error messages containing shell metacharacters. This vulnerability could allow an attacker to execute arbitrary commands in the context of the dom0 domain, potentially compromising the security of the entire system. Organizations using Qubes OS should prioritize patching this vulnerability to mitigate the risk of exploitation.
Original NVD Description
Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an attacker-controlled qube, because the "system" library function is used to process an error message that may have shell metacharacters. This occurs in core-admin-linux/file-copy-vm/qfile-dom0-agent.c.