Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.

I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to do harm when being executed with Wine on Linux, can do harm to my Linux system. I use a standard Wine installation. Wine is never executed as a superuser.

I guess it could read/write/delete files from my folder, and connect with the Internet.

I think, but am am not quite sure, that it can't install software. Could it install harmful (Firefox) plugins?

share|improve this question
add comment

2 Answers

up vote 10 down vote accepted

You are right about accessing the file system and internet, especially because the home folder is mapped with write permission by default. This implies that it can mess with your documents as well, for example adding macros to Open Office documents, deleting your mp3 files or sending interesting files to someone on the internet.

And yes, it can write to your Firefox profile and install an Addon.

Connecting to the internet means, that it can fetch commands from a C&C server to turn your computer into a drone.

I guess some maleware will fail to find those locations outside the standard windows folders. But other will just scan all drives for interesting places.

share|improve this answer
The malware would need to be Wine-aware in order to traverse the directory tree above /home/user/.wine/drive_c –  Amazed Jul 10 '11 at 23:43
@Amazed, in the default configuration / is mapped as Z:. So a Windows program can modify files in Z:\home\hendrik\documents without knowing anything about Wine or Linux. All it has to do is to look for documents outside C:\Documents and Settings\hendrik. This is not as unlikely as it may seem on first glance because it is the standard way to spread across network shares. –  Hendrik Brummermann Jul 11 '11 at 4:41
good point! I forgot about Z:\ –  Amazed Jul 11 '11 at 5:18
add comment

Theoretically, yes.

Firstly, a bit of background on Wine. Wine provides an executable loader for running Windows executables. Also installed or made use of optionally is a binfmt handler described here, which is how the linux kernel deduces what loader to execute - for example, somewhere built into the kernel is a binfmt handler for ELF files for Linux. Function calls from these executables are then translated by the Wine runtime into their equivalent Linux system calls. The Wine FAQ deals with the question of wine being an emulator.

So, back to your question - could Windows malware infect a Linux box? I said theoretically yes - here are the various threats you face:

  • Bugs in the format handlers. If a specially crafted executable causes Wine to incorrectly load the PE file, you might well be able to exploit it.
  • Bugs in Wine's function translation. This is the same as saying "bugs in the Windows API", if you like - if certain functions translated in Wine are susceptible to buffer overflows etc, then they can be exploited.
  • The fact that function calls are translated. This very fact in itself means malicious activity can happen.
  • The setup and limitations of the Wine install. What file systems have you mapped? Can the executable escape this "chroot"?

There is one key proviso here - being aware or planning for infecting Wine. If malware is written with the expectation that it may be run on Wine, then it can begin to use Wine specific exploits, possibly detecting that Z: is mapped to / and performing appropriate actions. The earlier points in my list above are the least likely, but also the most damaging if they occur.

However, most malware is not written for Wine. You can think of Wine as a separate build target, almost, since how it implements the Windows API is different to how Windows implements the API. Most malware is aimed squarely at Windows, so I'd expect the damage to occur only to the "Windows" install. Indeed some malware may not run, where the Wine developers have assumed strict usage of an API function and where Windows allows something different.

So, to cut a long story short, Wine increases your attack surface by a sizeable amount by allowing you to execute arbitrary Windows programs. The same general rules apply to Wine as apply to any piece of software:

  • Do you need it? If not, don't install it.
  • Is it up to date? If not, update it.
  • Be careful what you run with it. It is not a substitute for being careful with what you download, access and run.
share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.