CVE-2026-112210 in Red Hat
Summary
by MITRE • 10/19/2026
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the rhc-canonical-facts.service systemd unit represents a critical security flaw rooted in improper handling of file paths within a Linux environment. This specific issue is classified under CWE-59 as Improper Link Resolution Before File Access, commonly known as a symbolic link following or symlink race condition. The service operates with root privileges and interacts with files located inside directories owned by an unprivileged system user. Crucially, the application fails to verify whether these target files are symbolic links before performing operations on them. This lack of validation creates a window where a local attacker can manipulate the file system structure to redirect operations intended for legitimate data toward arbitrary locations within the filesystem that would otherwise be inaccessible due to standard permission restrictions.
The operational impact of this flaw is severe, as it facilitates privilege escalation from an unprivileged state to root access on the affected system. The attack vector requires a local attacker who has already compromised the privileged yggdrasil system service account or possesses sufficient permissions within the user-owned directory to create symbolic links. By crafting a symlink that points to a sensitive file such as /etc/shadow, /root/.ssh/authorized_keys, or other critical configuration files, the attacker can trick the root-running rhc-canonical-facts.service into overwriting or modifying these targets. Since the service runs with elevated privileges, any write operation performed through this manipulated link is executed with root permissions, effectively bypassing all standard access controls and allowing the attacker to take ownership of arbitrary files or inject malicious content into protected areas of the system.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1548.003, Abuse Elevation Control Mechanism: Symlink Following. The exploitation relies on the principle that many Unix-based applications assume file paths are stable and do not change between the time they are checked for existence or type and the time they are accessed. In this scenario, the attacker exploits the race condition inherent in symlink creation by placing a malicious link in the directory before the service processes it. This allows the attacker to hijack the execution context of the root process, turning a routine system management task into a mechanism for full system compromise. The severity is heightened because the prerequisite state involves compromising the yggdrasil account, which suggests that if an organization has multiple layers of defense and properly isolates services, this specific path may be blocked; however, in flat permission models or environments with weak service isolation, it serves as a direct ladder to root access.
Mitigation strategies must address both the immediate code defect and broader architectural weaknesses. The primary remediation involves modifying the rhc-canonical-facts.service implementation to enforce strict file type verification before any read or write operations occur. This can be achieved by using system calls that do not follow symbolic links, such as O_NOFOLLOW in open() syscalls, or by explicitly checking if a path is a symlink via lstat() and rejecting the operation if it returns true for S_ISLNK. Additionally, applying principle of least privilege to systemd units is essential; running services with minimal required permissions reduces the blast radius even if such vulnerabilities exist. System administrators should also ensure that directories owned by unprivileged users are not writable by other groups or world-writable where possible, and implement file integrity monitoring tools like AIDE or Tripwire to detect unauthorized changes to critical system files resulting from such exploitation attempts. Regular updates to the rhc package as provided by the vendor will eventually patch this flaw, but immediate mitigation through configuration hardening is recommended for high-risk environments.