@samitouri / QOSamiQemu / commits / a0414545a2

hw/9pfs: fix O_TRUNC bypass on read-only export

Guest 9p client opening a file with O_TRUNC on a read-only 9p file system using 9p2000.u protocol version, allowed to bypass 9p server's read-only check, eventually causing file(s) being truncated to empty file(s) on host's read-only export. Root cause is that 9p server's read-only check is using Linux open flags like O_WRONLY, O_RDWR, O_TRUNC, but checking them against the 9p Topen request's "mode" parameter, which has a different encoding (Otrunc = 0x10 vs. O_TRUNC = 0x200). Fix this by checking against the "flags" variable instead of the protocol's "mode" option. Because the "flags" variable is already converted to Linux encoding by omode_to_uflags() for 9p2000.u and by get_dotl_openflags() for 9p2000.L protocol version. Only 9p2000.u was affected by this bypass, 9p2000.L uses the Linux format on protocol level already. Fixes: 2c74c2cb4b ("hw/9pfs: Read-only support for 9p export") Fixes: CVE-2026-63318 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/4000 Reviewed-by: Daniel P. Berrangé <berrange@redhat.com> Link: https://lore.kernel.org/qemu-devel/E1wk2Dq-0019kY-JK@kylie.crudebyte.com Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>

Christian Schoenebeck committed Jul 15, 2026 at 18:10 UTC a0414545a212e27058fab7b057b018e75b8c4b13

1 file changed +2 -2

hw/9pfs/9p.c

+2 -2

@@ -2181,8 +2181,8 @@ static void coroutine_fn v9fs_open(void *opaque)

2181 flags = omode_to_uflags(mode);

2182 }

2183 if (is_ro_export(&s->ctx)) {

2184 - if (mode & O_WRONLY || mode & O_RDWR ||

2185 - mode & O_APPEND || mode & O_TRUNC) {

2184 + if (flags & O_WRONLY || flags & O_RDWR ||

2185 + flags & O_APPEND || flags & O_TRUNC) {

2186 err = -EROFS;

2187 goto out;

2188 }