Symlink Race Condition in libvirt Leading to Privilege Escalation

Executive Summary

CVE-2026-77159 is a symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to change ownership of an arbitrary file to the swtpm user.

Useful 0 Not Useful 0

Detection Guidance

Check for symlink manipulation in the swtpm log directory by inspecting the logfile path for unexpected symbolic links. Commands like 'ls -la /var/log/swtpm/' or 'readlink /var/log/swtpm/logfile' may reveal suspicious symlinks. Monitor file ownership changes in system logs or use 'auditctl' to track chown operations on critical files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to change ownership of critical system files to the swtpm user, potentially leading to privilege escalation or unauthorized access. This could allow modification of sensitive files, system configuration changes, or further exploitation of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise data integrity and access controls, which are critical for compliance with GDPR and HIPAA. Unauthorized file ownership changes may lead to unauthorized data access or modification, violating confidentiality and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the upstream fix by updating libvirt to a version that uses open(O_NOFOLLOW) and fchown() instead of path-based chown(). Ensure SELinux is in enforcing mode to limit the impact of potential exploits. Restrict access to the swtpm account and audit the swtpm log directory for unauthorized symlinks.

Useful 0 Not Useful 0