Vulnerability in the QubesOS management layer transferred
THREATQW27
· Transferred: Someone else handles this risk, such as an upstream project.
· Defined in catalog.py:3398
- Risk
- Medium impact × Medium likelihood = 6 medium
- After mitigations
- Medium impact × Medium likelihood = 6 medium (unchanged)
A vulnerability in the QubesOS management layer (e.g. Qubes RPC mechanism) could allow an attacker to cross VM boundaries and execute code in another domain.
Threat actors: Nation State / Law Enforcement Large Corporation
Mitigations
No mitigations in place.
Residual risk
Qubes rpc mechanisms present a significant attack surface exposed to all AppVM/guests, as such we want to limit code execution accross the board.
Related threats
This threat is part of: Attacker obtains code execution in sd-viewer VM THREATQW1, Attacker obtains code execution in the sd-app VM THREATQW18, Attacker obtains code execution in proxy VM THREATQW23, Attacker obtains code execution in any VM THREATQW36, Adversary exploits gzip parsing to get code execution THREATQW37
Where it applies
Applies to 1 component in 1 scenario.
Workstation: boot, provisioning and updates · Qubes OS and Xen
Notes
In scope for audit: No. Existing mitigations: - An attacker would need code execution on the host. - Qubes RPC policies targeting securedrop-workstation VMs are denied by default. - Qubes default RPC policy is to ask the user to confirm the action by typing target VM. - Qubes has significant assurance processes in place: https://www.qubes-os.org/doc/security-critical-code/. Further mitigations: Audit of Qubes security-critical tooling, sich such as qvm/qubes-* series of tools.
How this threat is matched
Listed for these components. A boundary covers every component inside it.