Qubes OS patches split-gpg2 filtering bypass allowing password prompt injection

The Qubes Security Team has issued QSB-124 disclosing a partial filtering bypass in split-gpg2, the component that isolates GnuPG private keys in dedicated backend qubes. The vulnerability arises from how split-gpg2 handles percent-encoded characters in INQUIRY responses: unescaped "%" characters are permitted on input but expanded to "%25" when forwarded, which can push lines past the protocol length limit. GnuPG's gpg-agent treats the overflow portion as a new command line, enabling injection of operations that split-gpg2's filter would normally block. In supported configurations, this allows a compromised client qube to spawn arbitrary password prompts with backend qube window decorations and capture user input, though secret key extraction remains prevented by the limited-capability "extra" gpg-agent socket.

All supported Qubes OS releases are affected, but only installations using the split-gpg2 package (distinct from split-gpg1/qubes-gpg-split) are impacted. The unsupported allow_keygen = yes configuration could theoretically enable secret key extraction, though the Qubes team explicitly does not security-support this option. Fixed packages are available in security-testing repositories as split-gpg2 1.1.16 for Qubes 4.3, with stable repository migration expected within one to two weeks. Users must restart backend qubes after updating templates.

Protocol handling flaw in split-gpg2's command filter

• INQUIRY response parsing: split-gpg2 allows unescaped "%" characters in incoming "D" commands responding to gpg-agent INQUIRY prompts, but correctly escapes them as "%25" on output to comply with the assuan protocol.
• Line length overflow: The percent-encoding expansion increases line length beyond the protocol limit that split-gpg2 validates only on incoming lines, not on reconstructed outgoing lines.
• GnuPG agent behavior: For normal commands, overlong lines trigger fatal errors; for INQUIRY responses, the agent aborts the original command and parses the excess bytes as a new, unfiltered command line.
• Attack vector: A malicious qube can inject commands to create arbitrary password prompts within the backend qube's window borders, receiving the user's typed response.
• Capability limitation: The supported configuration uses an "extra" gpg-agent socket with restricted capabilities, preventing secret key extraction or manipulation even if a passphrase is compromised.

Why it matters

This bulletin highlights the ongoing challenges in securing inter-qube communication boundaries in high-assurance operating systems, where even protocol-compliant encoding transformations can introduce exploitable semantic gaps. For Qubes OS users relying on split-gpg2 for cryptographic isolation—particularly journalists, activists, and security professionals operating in compartmentalized threat models—prompt application of the 1.1.16 update is essential to maintain the integrity of the trusted computing base. The vulnerability also serves as a cautionary example for other sandboxed gpg-agent implementations that perform command filtering and reconstruction.