Every CVE Search/ Get API key

CVE-2021-20263

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new ...

3.3 LowFix available

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.38%Down 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 3.3

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Record
CVE-2021-20263
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Weakness
CWE-281
Updated
2026-11-02
CVE List No score

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Record
CVE-2021-20263
Weakness
CWE-281
Updated
2026-11-02
EUVDEUVD-2021-7699 No score

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Record
EUVD-2021-7699
Updated
2026-11-03
GitHub AdvisoriesGHSA-349h-phx6-ghfj 3.3

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new ...

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Record
GHSA-349h-phx6-ghfj
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-281
Updated
2026-11-02
OSV 3.3

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Record
CVE-2021-20263
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-20263 3.3

A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.

Record
DEBIAN-CVE-2021-20263
CVSS 3.1
3.3 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2021:1942-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
  • Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
  • Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
  • Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
  • Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
  • For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)
Record
openSUSE-SU-2021:1942-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11287-1 No score

qemu-6.1.0-32.1 on GA media

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11287-1
Updated
2026-11-02
OSVSUSE-SU-2021:1942-1 No score

Security update for qemu

This update for qemu fixes the following issues:

  • Switch method of splitting off hw-s390x-virtio-gpu-ccw.so as a module to what was accepted upstream (bsc#1181103)
  • Fix OOB access in sdhci interface (CVE-2020-17380, bsc#1175144, CVE-2020-25085, bsc#1176681, CVE-2021-3409, bsc#1182282)
  • Fix potential privilege escalation in virtiofsd tool (CVE-2021-20263, bsc#1183373)
  • Fix OOB access (stack overflow) in rtl8139 NIC emulation (CVE-2021-3416, bsc#1182968)
  • Fix heap overflow in MSIx emulation (CVE-2020-27821, bsc#1179686)
  • Fix package scripts to not use hard coded paths for temporary working directories and log files (bsc#1182425)
  • QEMU BIOS fails to read stage2 loader on s390x (bsc#1186290)
  • For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25707, bsc#1178683, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2020-29129, bsc#1179484, CVE-2021-3419, bsc#1182975)
Record
SUSE-SU-2021:1942-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu
Debian:12
 before 1:5.2+dfsg-9
1:5.2+dfsg-9
qemu
Debian:13
 before 1:5.2+dfsg-9
1:5.2+dfsg-9
qemu
Debian:14
 before 1:5.2+dfsg-9
1:5.2+dfsg-9
qemu
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 14 CVEs
 before 5.2.0-17.1
5.2.0-17.1
qemu
SUSE:Linux Enterprise Module for Server Applications 15 SP3
From an advisory covering 14 CVEs
 before 5.2.0-17.1
5.2.0-17.1
qemu
openSUSE:Leap 15.3
From an advisory covering 14 CVEs
 before 5.2.0-17.1
5.2.0-17.1
qemu
openSUSE:Tumbleweed
From an advisory covering 135 CVEs
 before 6.1.0-32.1
6.1.0-32.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-20263 is a low vulnerability (CVSS 3.3) in Qemu, published March 9, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in qemu 1:5.2+dfsg-9.

References

Show 159 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open