Description

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-10T21:17:23.550Z",
  "pubdate": "2026-08-10T21:17:23.550Z",
  "executiveSummary": "A privilege escalation vulnerability exists in libvirt involving the virFileChownFiles() function.\nThe flaw allows a local attacker operating within a confined environment as the swtpm user to exploit a symlink-following behavior.\nBy strategically planting symbolic links within the swtpm state directory, an adversary can manipulate the root-privileged libvirt daemon into arbitrarily modifying file ownership to the swtpm user.\nThis unauthorized ownership reassignment breaks sandbox boundaries, enabling a confined low-privileged entity to gain control over arbitrary system files.\nThe risk implication is severe, as compromising file ownership facilitates local privilege escalation toward root-level capabilities.\nSuccessful exploitation requires local access and execution as the confined swtpm user, combined with the ability to create symbolic links in the targeted state directory prior to the daemon executing ownership modifications.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of file paths and metadata operations within the virFileChownFiles() function in libvirt.\nWhen the libvirt daemon processes file ownership changes inside the swtpm state directory, the underlying file operations improperly resolve symbolic links rather than handling them safely.\nAn attacker running under the confined swtpm user identity initiates the attack flow by pre-creating a symbolic link pointing to a chosen arbitrary system file within the swtpm state directory.\nWhen the privileged root-level libvirt daemon interacts with the state directory, it traverses the attacker-controlled symbolic link during the execution of virFileChownFiles().\nInstead of restricting the ownership operation to the intended directory bounds, the daemon blindly follows the symlink and recursively or directly alters the ownership of the pointed-to arbitrary file, assigning ownership to the swtpm user.\nThe vulnerable component is the file ownership management routine within libvirt, specifically the virFileChownFiles() function.\nThe vulnerability requires local access with the specific execution context of the confined swtpm user.\nNo network exposure is required, as the attack vector is strictly local, leveraging filesystem interactions and local process privileges.\nPost-exploitation impact includes the swtpm user gaining file ownership control over arbitrary system files, which can be leveraged to facilitate broader system compromise and complete privilege escalation to root."
}