Description

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-11T11:16:54.677Z",
  "pubdate": "2026-09-11T11:16:54.677Z",
  "executiveSummary": "A privilege escalation vulnerability exists in the libvirt virtualization API, specifically within the qemuTPMEmulatorPrepareHost() function. This flaw is categorized as a symlink-following vulnerability, where the application incorrectly handles file ownership assignment for swtpm logfiles.\nThe vulnerability allows a local attacker, specifically one with access to the swtpm account, to manipulate the file system by replacing the expected logfile with a symbolic link. Because libvirtd executes with root privileges, the application inadvertently facilitates the transfer of ownership of arbitrary system files to the swtpm user. This results in a critical security compromise, enabling the attacker to gain unauthorized control over sensitive system files that would otherwise be protected by root-level permissions.\nThe exploitation requires local access and the ability to interact with the swtpm environment. Successful exploitation leads to a direct increase in attacker privileges, potentially resulting in full system compromise depending on which files are targeted for ownership change. The risk is significant due to the elevated privileges of the libvirtd daemon, which acts as a vector for granting the swtpm user control over restricted resources.",
  "technicalDetails": "The vulnerability originates in the qemuTPMEmulatorPrepareHost() function within libvirt, which is responsible for initializing the environment for the Software TPM (swtpm) emulator. The root cause is the usage of a path-based chown() system call on the swtpm logfile without implementing adequate security checks to detect or prevent the use of symbolic links.\nIn a typical operational flow, libvirtd, running with root privileges, attempts to adjust the permissions and ownership of the swtpm logfile to ensure the swtpm process can write to its designated output location. The function executes the chown() operation based on the file path provided, assuming the path points to a legitimate, non-malicious file.\nAn attacker with access to the swtpm user context can exploit this by monitoring the timing or initiation of the qemuTPMEmulatorPrepareHost() call. By deleting or moving the original logfile and replacing it with a symbolic link pointing to a critical system file (e.g., /etc/shadow or other sensitive configuration files), the attacker induces a race condition.\nWhen libvirtd executes the chown() call, the kernel follows the symbolic link because the function does not utilize secure alternatives like fchown() or O_NOFOLLOW flags to ensure the operation is constrained to the intended target. Consequently, libvirtd silently changes the ownership of the arbitrary file pointed to by the attacker to the swtpm user.\nOnce the target file's ownership has been modified, the swtpm user gains read and write access to the previously restricted system file. This allows the attacker to read sensitive data, modify configurations, or inject malicious content, thereby escalating their privileges from a restricted service account to the level of the swtpm user's controlled resource. Given that the libvirtd daemon operates with root privileges, this design flaw effectively circumvents file system permission boundaries, allowing a lower-privileged user to influence root-level operations via time-of-check to time-of-use (TOCTOU) exploitation patterns. No network exposure is required for this attack, as it is strictly contained to the local system environment and necessitates existing local access to the swtpm-related service account."
}