EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 30·5 min read
Arbitrary code execution in QubesOS via copy-to-VM error reporting backchannel
TL;DR
A security vulnerability in QubesOS allows arbitrary code execution through the `qvm-copy-to-vm` error reporting mechanism, posing risks when transferring files from dom0 to compromised VMs.
✦ Why It Matters
Update your QubesOS installation today to protect against this critical vulnerability.
Key Takeaways
- Update QubesOS to version 4.3.22 to patch the vulnerability.
- Be cautious when transferring files to untrusted qubes.
- Regularly check for Qubes Security Bulletins for updates.
- Understand the implications of file transfer tools in virtual environments.
How It Works
The qvm-copy-to-vm tool uses a simplified file transfer protocol that includes error reporting. When an error occurs, the filename is processed without adequate sanitization, allowing attackers to inject commands into the error handling mechanism, which then executes them in dom0.