Bug 2555486

Summary:	CVE-2026-112210 rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Thibault Guittet <tguittet>
Component:	rhc	Assignee:	mhorky
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	go-sig, mhorky
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["769a9174-2526-450a-8a2c-e43ef5380cd7"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-21 11:29:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2555474

Description Thibault Guittet 2026-10-19 10:32:30 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A symlink-following vulnerability was found in rhc-canonical-facts.service. The service runs as root and performs `touch`, `chown yggdrasil:yggdrasil`, and `StandardOutput=truncate:` on `/var/lib/yggdrasil/canonical-facts.json` — a path inside a directory owned by the unprivileged yggdrasil user (via StateDirectory=yggdrasil). None of these operations reject symlinks.

An attacker with code execution as yggdrasil can replace canonical-facts.json with a symlink to an arbitrary file. When the service triggers (daily timer or `rhc connect`), the target file's ownership is transferred to yggdrasil and its content is truncated and overwritten.

The service has no User= directive, no systemd sandboxing, and no confined SELinux domain (systemd-analyze security: 9.6 UNSAFE). On RHEL 10.2 with SELinux Enforcing, the full exploit chain was confirmed against var_lib_t and systemd_unit_file_t targets. The /etc/shadow path is blocked by SELinux (init_t cannot open shadow_t for StandardOutput), but targeting systemd unit files provides a path to root.

Introduced in rhc v0.3.0. Versions prior to 0.3.0 do not ship this service file.

External reference: PSIRTSUPT-25922

Comment 1 mhorky 2026-10-20 11:27:57 UTC

The maintainers have been contacted, we will be working on some kind of resolution.

Comment 3 Thibault Guittet 2026-10-21 11:29:41 UTC

CVE-2026-112210 has been reclassified as a hardening improvement, not a security vulnerability. The upstream development team reviewed the report and determined it does not meet the threshold for a CVE. Closing this tracker accordingly.