A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libvirt-daemon-proxy-debuginfoUpgrade libvirt-daemon-driver-nodedevUpgrade libvirtUpgrade libvirt-nss-debuginfoUpgrade libvirt-clientUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemonUpgrade libvirt-nssUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-nwfilter-debuginfoUpgrade libvirt-daemon-driver-networkUpgrade libvirt-debuginfoUpgrade libvirt-daemon-driver-secret-debuginfoUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-ssh-proxyUpgrade libvirt-libs-debuginfoUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-debugsourceUpgrade libvirt-daemon-driver-nodedev-debuginfoUpgrade libvirt-client-debuginfoUpgrade libvirt-daemon-driver-interface-debuginfoUpgrade libvirt-daemon-common-debuginfoUpgrade libvirt-daemon-log-debuginfoUpgrade libvirt-daemon-driver-network-debuginfoUpgrade libvirt-ssh-proxy-debuginfoUpgrade libvirt-daemon-driver-storage-disk-debuginfoUpgrade libvirt-daemon-proxyUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-storage-logical-debuginfoUpgrade libvirt-docsUpgrade libvirt-daemon-debuginfoUpgrade libvirt-client-qemuUpgrade libvirt-daemon-lockUpgrade libvirt-daemon-driver-storage-core-debuginfoUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-plugin-lockdUpgrade libvirt-daemon-driver-qemu-debuginfoUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-logUpgrade libvirt-daemon-plugin-lockd-debuginfoUpgrade libvirt-daemon-qemuUpgrade libvirt-libsUpgrade libvirt-daemon-lock-debuginfoUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-driver-storage | Sep 30, 2026 | Sep 11, 2026 |
| Redhat_linux | — | No solution exists | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade libvirt0-hweUpgrade libvirt-daemon-system-hweUpgrade libvirt-daemonUpgrade libvirt-daemon-hweUpgrade libvirt0Upgrade libvirt-daemon-system | Sep 28, 2026 | Sep 28, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub