CVE-2026-77159
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Summary
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-61: UNIX Symbolic Link (Symlink) Following
Workarounds
On Red Hat Enterprise Linux, SELinux in enforcing mode (the default) confines the swtpm process to the swtpm_t domain, which restricts the creation of symlinks to arbitrary file types and limits the scope of any ownership change, reducing the practical impact of this flaw. Ensure SELinux is not disabled or set to permissive mode.
References
- https://access.redhat.com/security/cve/CVE-2026-77159
- https://bugzilla.redhat.com/show_bug.cgi?id=2531811
- https://gitlab.com/libvirt/libvirt/-/work_items/909
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.