Bug 2513834

Summary: CVE-2026-63622 libvirt: swtpm privilege escalation via symlink following [fedora-all]
Product: [Fedora] Fedora Reporter: Mauro Matteo Cascella <mcascell>
Component: libvirtAssignee: Fedora Virtualization Maintainers <virt-maint>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: 45CC: berrange, clalancette, crobinso, jforbes, jiyin, laine, libvirt-maint, suraj.ghimire7, virt-maint
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["9e6998fc-fbda-4132-a39c-c75ec0570019"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2513065    

Description Mauro Matteo Cascella 2026-08-11 08:32:04 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A symlink-following vulnerability was found in libvirt's virFileChownFiles() function in src/util/virfile.c. This function is called from src/qemu/qemu_tpm.c to change ownership of the swtpm state directory when starting a QEMU domain.

The function used stat() (via virFileIsRegular()) and chown(), both of which follow symlinks. A process running as the confined swtpm user (tss) can plant a symlink inside the swtpm state directory pointing to an arbitrary file. When the root-level libvirt daemon starts the next domain, it calls virFileChownFiles() which follows the symlink and chowns the target file to the tss user. This allows escalation from the swtpm sandbox to root-level file ownership control.

The fix replaces stat()/chown() with lstat()/lchown() to avoid following symlinks on the final path component.

Upstream fix: https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b
Comment 1 Aoife Moloney 2026-08-17 15:51:30 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.