A critical OS command injection vulnerability in Qubes OS allows an attacker-controlled qube to execute arbitrary commands within dom0, potentially compromising the entire system.

The vulnerability is an OS command injection flaw (CWE-78) occurring in the qfile-dom0-agent.c file. It arises because the system library function improperly processes error messages containing shell metacharacters, which can be triggered by an unauthenticated attacker via a qvm-copy-to-vm call from a compromised qube.

Successful exploitation of this vulnerability permits an attacker to escape the security boundaries of an individual qube and execute commands with elevated privileges in dom0. Given the CVSS score of 7.9, this represents a high-severity risk that undermines the fundamental security architecture of Qubes OS, potentially leading to total system compromise, data theft, and unauthorized persistence.

Immediate Action: Update the qubes-core-dom0-linux package to version 4.3.22 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review system logs in dom0 for unexpected process execution or abnormal calls to the qvm-copy-to-vm utility.

Compensating Controls: While no direct WAF exists for internal IPC mechanisms, users should strictly limit the data transferred between qubes and avoid initiating copy operations from untrusted or compromised environments until the patch is applied.

Public Exploit Available: No

This vulnerability represents a significant breach of the isolation model that defines Qubes OS. Administrators must prioritize updating the core dom0 components immediately to close this injection vector. Failure to patch allows a compromised guest qube to escalate privileges to the host level, rendering the security benefits of the platform void.