How severe is CVE-2022-0358?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.8 out of 10.

What type of vulnerability is CVE-2022-0358?

This is classified as CWE-273, which is a common weakness in software security.

CVE-2022-0358 - HIGH Severity | CVSS 7.8

Vulnerability Description

A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.

Related Vulnerabilities

CVE-2006-2916

HIGH

CVSS:7.8(High)

artswrapper in aRts, when running setuid root on Linux 2.6.0 or later versions, does not check the return value of the setuid function call, which allows local users to gain root privileges by causing...

CWE-2732006

CVE-2018-8599

HIGH

CVSS:7.8(High)

An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector Service improperly impersonates certain file operations, aka "Diagnostics Hub Standard Collector Service Elev...

CWE-2732018

CVE-2019-18276

HIGH

CVSS:7.8(High)

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by settin...

CWE-2732019

CVE-2019-20044

HIGH

CVSS:7.8(High)

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by e...

CWE-2732019

CVE-2023-34322

HIGH

CVSS:7.8(High)

For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV g...

CWE-2732023

CVE-2023-35692

HIGH

CVSS:7.8(High)

In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation. This could lead to local escalation of privilege wit...

CWE-2732023