Bug 2531811 (CVE-2026-77159)

Summary: CVE-2026-77159 libvirt: Unsafe chown in qemuTPMEmulatorPrepareHost() allows arbitrary file ownership change via symlink
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2531818    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-11 09:45:17 UTC 
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function (src/qemu/qemu_tpm.c). The function uses a path-based chown() to set ownership of the swtpm logfile without verifying that the path is not a symbolic link. Since the log directory is writable by the swtpm user, a local attacker with access to the swtpm account can replace the logfile with a symlink pointing to an arbitrary file. When libvirtd (running as root) starts a QEMU domain with an emulated TPM, it follows the symlink and transfers ownership of the target file to swtpm:swtpm, allowing the attacker to then modify that file.

The upstream fix replaces the path-based chown() with open(O_NOFOLLOW) + fchown() on the file descriptor.

External reference: https://gitlab.com/libvirt/libvirt/-/work_items/909