CVE-2026-77159 in Red Hat
Summary
by MITRE • 09/11/2026
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in libvirt involves a critical path traversal and privilege escalation flaw within the qemuTPMEmulatorPrepareHost function. This specific component is responsible for preparing the host environment for Trusted Platform Module (TPM) emulation, which relies on the software TPM emulator or swtpm to manage virtualized hardware security states. The core technical deficiency lies in how the application handles file system operations during this initialization phase. Specifically, the function invokes a chown() system call to change the ownership of the swtpm log file to ensure proper access control and logging capabilities. However, the implementation fails to validate whether the target path is a symbolic link before executing the ownership transfer operation. This oversight creates a classic symlink-following vulnerability where the operating system resolves the symbolic link to its actual destination rather than treating it as a distinct entity, allowing an attacker to redirect administrative actions toward unintended targets.
From an operational perspective, this flaw presents a significant risk for local privilege escalation within systems running libvirt and swtpm services. An attacker who has gained access to the swtpm user account or can influence files accessible by that service principal is able to exploit this misconfiguration. By creating a symbolic link at the expected location of the swtpm log file, pointing instead to an arbitrary sensitive file on the system such as /etc/shadow or other critical configuration files, the attacker forces libvirtd, which executes with root privileges, to change the ownership of that target file to the unprivileged swtpm user. This action effectively grants the low-privilege service account read and write access to high-value system resources, bypassing standard permission models and potentially allowing further exploitation steps such as credential theft or configuration manipulation.
This vulnerability aligns with Common Weakness Enumeration CWE-59, which describes Improper Link Resolution Before File Access, commonly known as a symlink race condition or path traversal issue. The attack vector is classified under the MITRE ATT&CK framework as Local Privilege Escalation via file system permissions modification, specifically leveraging improper access control mechanisms to gain unauthorized privileges. The impact extends beyond simple data exposure; by altering ownership of critical files, an attacker can potentially modify binary executables or configuration scripts that are subsequently executed with elevated privileges, leading to full system compromise.
Mitigation strategies must focus on hardening the file handling routines within libvirt and securing the underlying operating system environment. Developers should implement strict validation checks before performing any chown() operations, ensuring that the target path is not a symbolic link by using functions like lstat() instead of stat(), or explicitly checking for S_ISLNK flags in the returned status structure. Additionally, employing openat() with O_NOFOLLOW flags provides an additional layer of protection against symlink resolution during file descriptor creation. System administrators should also enforce strict permissions on directories containing service logs and utilize mandatory access control systems like SELinux to restrict what files specific services can modify regardless of ownership changes. Regular auditing of log directory contents and monitoring for unexpected symbolic links in service-specific paths are recommended operational security practices to detect potential exploitation attempts early.