—-—-—-— Reply above this line.
Mauro Matteo Cascella commented: Hi Ashish, Thank you for your detailed vulnerability reports. We have reviewed the findings and assigned CVEs for the three that we assessed as security-relevant code defects in the upstream spice-vdagent codebase: *CVE-2026-57964 - Authentication bypass on macOS/BSD due to dummy session info *CVE-2026-57965 - Integer overflow in udscs_write() leading to heap buffer overflow *CVE-2026-57966 - Path traversal in file transfer via unsanitized filename Regarding the remaining two findings: *World-writable virtio serial port - The device permissions on /dev/tty.com.redhat.spice.0 are set by the macOS virtio driver (IOKit/Virtualization.framework), not by spice-vdagent code. This is a platform/driver configuration issue that should be reported to the UTM project or Apple. *Protocol injection via virtio loopback - The root cause is the macOS/UTM virtio driver loopback behavior, not a spice-vdagent design flaw. The daemon was designed for environments where the virtio port carries legitimate host-side messages. We would also like to note that while these code defects are valid, exploitation requires a malicious or compromised SPICE host. Standard deployment models assume the host is inherently trusted, mitigating the real-world risk. We strongly recommend reporting these issues directly to the spice-vdagent upstream project at [1]https://gitlab.freedesktop.org/spice/linux/vd_agent so that patches can be developed and released for all downstream consumers. Thank you. ---------------------------------------------------------------------------------------- [1] https://gitlab.freedesktop.org/spice/linux/vd_agent View request: https://redhat.atlassian.net/servicedesk/customer/portal/68/PSIRTSUPT-17312?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0Z3QiOiJhbm9ueW1vdXMtbGluayIsInFzaCI6ImEyMTRmNTQ4ZTdmZWZlNzM1ZDIzOGQ1NWM4N2NhZDVmMjgzYTU3MjViNjI2ZmNiYjZkNzE4NTM2YTk2ODdhMzYiLCJpc3MiOiJzZXJ2aWNlZGVzay1qd3QtdG9rZW4taXNzdWVyIiwiY29udGV4dCI6eyJ1c2VyIjoiMjAyNDQ3IiwiaXNzdWUiOiJQU0lSVFNVUFQtMTczMTIifSwiZXhwIjoxNzg0OTExMTkxLCJpYXQiOjE3ODI0OTE5OTF9._nxSXxuIqDT7v5_ceaDpWA1L8CRR8BATyzVnJPdRhHU&sda_source=notification-email Turn off this request's notifications: https://redhat.atlassian.net/servicedesk/customer/portal/68/PSIRTSUPT-17312/unsubscribe?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0Z3QiOiJhbm9ueW1vdXMtbGluayIsInFzaCI6Ijc5ZDE0Y2FhMDUyMmNiZWZiYWM0NWM4NTkxZjg5MmFiOTBmMDAzMWQ0NTljYzUxODUwNTAyMzY1MzJiNjllMmQiLCJpc3MiOiJzZXJ2aWNlZGVzay1qd3QtdG9rZW4taXNzdWVyIiwiY29udGV4dCI6eyJ1c2VyIjoidWc6MTI4M2QyOTAtZDJhNS00Y2FkLTk1ZmMtZmM2NDE2NDQ2YTJhIiwiaXNzdWUiOiJQU0lSVFNVUFQtMTczMTIifSwiZXhwIjoxNzg0OTExMTkxLCJpYXQiOjE3ODI0OTE5OTF9.ING00mxb0h5KYuEn6BdumRfoDnlx4_BAVdtRKJ0azvA This is shared with Ashish Kunwar, spice-devel, and [email protected] ------------------------------ Powered by Jira Service Management https://www.atlassian.com/software/jira/service-desk/powered-by?utm_medium=jira-in-product&utm_source=jira_service_desk_email_footer&utm_content=redhat
