Bug 2555474 (CVE-2026-112210)

Summary:	CVE-2026-112210 rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2555486
Bug Blocks:

Description OSIDB Bzimport 2026-10-19 10:20:17 UTC

A symlink-following vulnerability was found in rhc-canonical-facts.service. The service runs as root and performs `touch`, `chown yggdrasil:yggdrasil`, and `StandardOutput=truncate:` on `/var/lib/yggdrasil/canonical-facts.json` — a path inside a directory owned by the unprivileged yggdrasil user (via StateDirectory=yggdrasil). None of these operations reject symlinks.

An attacker with code execution as yggdrasil can replace canonical-facts.json with a symlink to an arbitrary file. When the service triggers (daily timer or `rhc connect`), the target file's ownership is transferred to yggdrasil and its content is truncated and overwritten.

The service has no User= directive, no systemd sandboxing, and no confined SELinux domain (systemd-analyze security: 9.6 UNSAFE). On RHEL 10.2 with SELinux Enforcing, the full exploit chain was confirmed against var_lib_t and systemd_unit_file_t targets. The /etc/shadow path is blocked by SELinux (init_t cannot open shadow_t for StandardOutput), but targeting systemd unit files provides a path to root.

Introduced in rhc v0.3.0. Versions prior to 0.3.0 do not ship this service file.

External reference: PSIRTSUPT-25922