Bug 2513065 (CVE-2026-63622)

Summary:	CVE-2026-63622 libvirt: swtpm privilege escalation via symlink following
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2513834
Bug Blocks:

Description OSIDB Bzimport 2026-08-10 09:48:58 UTC

A symlink-following vulnerability was found in libvirt's virFileChownFiles() function in src/util/virfile.c. This function is called from src/qemu/qemu_tpm.c to change ownership of the swtpm state directory when starting a QEMU domain.

The function used stat() (via virFileIsRegular()) and chown(), both of which follow symlinks. A process running as the confined swtpm user (tss) can plant a symlink inside the swtpm state directory pointing to an arbitrary file. When the root-level libvirt daemon starts the next domain, it calls virFileChownFiles() which follows the symlink and chowns the target file to the tss user. This allows escalation from the swtpm sandbox to root-level file ownership control.

The fix replaces stat()/chown() with lstat()/lchown() to avoid following symlinks on the final path component.

Upstream fix: https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b

Comment 4 errata-xmlrpc 2026-09-08 05:11:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:64773 https://access.redhat.com/errata/RHSA-2026:64773

Comment 5 errata-xmlrpc 2026-09-08 15:35:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:65516 https://access.redhat.com/errata/RHSA-2026:65516

Comment 6 errata-xmlrpc 2026-09-08 16:13:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:65515 https://access.redhat.com/errata/RHSA-2026:65515

Comment 7 errata-xmlrpc 2026-09-09 05:22:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:65803 https://access.redhat.com/errata/RHSA-2026:65803

Comment 8 Jon Orris 2026-09-17 06:11:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:68513 https://access.redhat.com/errata/RHSA-2026:68513

Comment 9 Jon Orris 2026-09-17 11:10:09 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:68594 https://access.redhat.com/errata/RHSA-2026:68594

Comment 10 Jon Orris 2026-09-21 03:35:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:69114 https://access.redhat.com/errata/RHSA-2026:69114

Comment 11 Jon Orris 2026-09-21 03:57:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:69131 https://access.redhat.com/errata/RHSA-2026:69131

Comment 12 Jon Orris 2026-10-02 02:26:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:74424 https://access.redhat.com/errata/RHSA-2026:74424

Comment 13 Jon Orris 2026-10-05 07:03:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:75583 https://access.redhat.com/errata/RHSA-2026:75583