Hi, I'm disclosing 5 security vulnerabilities in spice-vdagent 0.22.1 affecting all macOS/BSD builds, with partial impact on Linux. These were discovered and confirmed on 2026-04-25 and cross-validated on Linux/Proxmox on 2026-05-03.
The 5 findings chain into a full SPICE compromise: authentication bypass → virtio man-in-the-middle → clipboard theft/injection → persistent service denial-of-service. All stages are 100% deterministic with no race conditions. Individual advisories follow as separate emails [1/5] through [5/5], each with full technical detail, root cause analysis, PoC output, and suggested fixes. SUMMARY OF FINDINGS ==================== #1 Authentication Bypass on macOS/BSD (CRITICAL — CVSS 8.8) CWE-287 | dummy-session-info.c returns NULL → all auth checks skipped Impact: Any local user becomes the daemon's trusted agent Affected: ALL macOS, FreeBSD, OpenBSD, NetBSD builds #2 Integer Overflow in udscs_write() → Heap Buffer Overflow (CRITICAL — CVSS 9.6) CWE-190 + CWE-122 | sizeof(header) + size wraps to 0 → 4GB memcpy past allocation Impact: Root daemon code execution from malicious SPICE host ASAN-confirmed heap-buffer-overflow #3 Path Traversal in File Transfer (HIGH) CWE-22 | g_build_filename() discards save_dir for absolute paths Impact: Arbitrary file write as daemon user from malicious host #4 World-Writable Virtio Serial Port on macOS (HIGH) CWE-732 | /dev/tty.com.redhat.spice.0 is crw-rw-rw- Impact: Any user reads/writes raw SPICE protocol, can TIOCEXCL lock daemon out #5 Protocol Injection via Virtio Loopback → Persistent DoS (HIGH — CVSS 7.1) CWE-20 + CWE-400 | UDSCS messages echo back as VDAgent protocol Impact: Permanent SPICE service crash loop until VM reboot FULL EXPLOIT CHAIN (CONFIRMED) =============================== Stage 1: Auth bypass (#1) → become trusted agent (zero credential checks) Stage 2: Virtio RDWR + TIOCEXCL (#4) → lock daemon out, man-in-the-middle Stage 3: Clipboard theft/injection → steal host credentials, inject commands Stage 4: Protocol injection (#5) → persistent SPICE DoS (crash loop every 2s) All 4 stages confirmed on macOS 26.4 + 26.4.1 (arm64 VM via UTM/Virtualization.framework). ADDITIONAL LOWER-SEVERITY FINDINGS (not sent separately) ========================================================== #6 Signed/unsigned mismatch in clipboard size check (MEDIUM, CWE-195) vdagentd.c:92 — max_clipboard is signed int, compared with uint32_t size Setting max_clipboard=0x80000000 makes effective limit 2GB #7 Integer overflow in monitor config size calculation (MEDIUM, CWE-190) vdagentd.c:209 — num_of_monitors * sizeof(VDAgentMonConfig) overflows uint32_t #8 Connection flood DoS via auth bypass (HIGH, CWE-400) 252 simultaneous connections exhaust root daemon fd table #9 Unvalidated memory allocation via UDSCS messages (LOW-MEDIUM, CWE-789) g_realloc(header.size) with zero validation → daemon RSS grew to 3.7GB+ Full technical report (REPORT.md) and all PoC source code are attached to the individual emails. TESTED ON ========== - spice-vdagent 0.22.1 - macOS 26.4 (Build 25E246) + macOS 26.4.1 (Build 25E253), arm64 VM - Virtualization.framework (UTM) on Mac Mini M4 - Cross-validated: Debian 12.13 / Proxmox VE 8.4.19 SUGGESTED FIXES (SUMMARY) =========================== 1. Auth bypass: Use getpeereid() on macOS/BSD regardless of ConsoleKit/systemd 2. Heap overflow: Add size > MAX_SAFE_SIZE guard in udscs_write() before addition 3. Path traversal: Reject absolute paths and ".." components in file transfer names 4. Virtio permissions: Set device to crw-rw---- (root:wheel) 5. Protocol injection: Tag/validate outbound messages to distinguish from inbound Please let me know if you need additional information or have questions about reproduction. Regards, Ashish Kunwar (@D0rkerDevil) [email protected]
