These interactions are restricted by the system's RPC policies. [5] In particular, qrexec can be used to allow less trusted qubes to communicate with more trusted qubes, including dom0. Normally, the calling side can send data to the remote services' standard input and receive its standard output, standard error, and exit code data. Since it handles untrusted data flows, qrexec is designed under the assumption that an adversary will use it in order to launch an attack against one qube from another qube. Therefore, qrexec treats incoming data as untrusted and carefully sanitizes it. For example, when qrexec output is connected to a terminal, `qrexec-client` and `qrexec-client-vm` remove terminal control sequences. However, due to a mistake in qrexec message type handling, the calling side can send data marked as "standard error" (`MSG_DATA_STDERR`), and the remote side will print it to the standard error of the process handling incoming qrexec connections. This data flow was not expected. Such messages should be rejected, as they are expected only in the other direction. Consequently, this data is not appropriately sanitized, and potentially-malicious data may end up in log output. Credits -------- This issue was discovered by Demi Marie Obenour. References ----------- [1] https://www.qubes-os.org/doc/testing/ [2] https://www.qubes-os.org/doc/how-to-update/ [3] https://www.qubes-os.org/doc/qrexec/ [4] https://www.qubes-os.org/doc/qrexec-internals/ [5] https://www.qubes-os.org/doc/rpc-policy/ -- The Qubes Security Team https://www.qubes-os.org/security/