A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libvirt-client-qemuUpgrade libvirt-daemon-driver-storageUpgrade libvirt-libsUpgrade libvirt-docsUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-plugin-lockd-debuginfoUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-logUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-develUpgrade libvirt-daemon-plugin-lockdUpgrade libvirt-daemon-driver-qemu-debuginfoUpgrade libvirt-daemon-driver-storage-core-debuginfoUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-lock-debuginfoUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-lockUpgrade libvirt-daemon-driver-storage-logical-debuginfoUpgrade libvirt-daemon-debuginfoUpgrade libvirt-nssUpgrade libvirt-clientUpgrade libvirt-debuginfoUpgrade libvirt-nss-debuginfoUpgrade libvirtUpgrade libvirt-daemon-proxyUpgrade libvirt-daemon-driver-network-debuginfoUpgrade libvirt-ssh-proxy-debuginfoUpgrade libvirt-daemon-common-debuginfoUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-log-debuginfoUpgrade libvirt-ssh-proxyUpgrade libvirt-libs-debuginfoUpgrade libvirt-daemon-driver-interface-debuginfoUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-nodedev-debuginfoUpgrade libvirt-debugsourceUpgrade libvirt-client-debuginfoUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-proxy-debuginfoUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-storage-disk-debuginfoUpgrade libvirt-daemon-driver-secret-debuginfoUpgrade libvirt-daemon-driver-nwfilter-debuginfoUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon | Sep 30, 2026 | Sep 11, 2026 |
| Redhat_linux | — | No solution exists | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade libvirt0-hweUpgrade libvirt-daemonUpgrade libvirt-daemon-system-hweUpgrade libvirt-daemon-hweUpgrade libvirt0Upgrade libvirt-daemon-system | Sep 28, 2026 | Sep 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub