CVE-2018-16872

Name of the Vulnerable Software and Affected Versions: qemu (affected versions not specified)

Description: A flaw in qemu's Media Transfer Protocol (MTP) implementation allows an attacker with write access to the host filesystem shared with a guest to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. This is due to a TOCTTOU (Time-of-Check-to-Time-of-Use) problem, where the code opening files and directories does not consider that the underlying filesystem may have changed since the time lstat(2) was called. Access to the filesystem may be local or via a network share protocol such as CIFS.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.