USN-8831-1: libvirt vulnerabilities
Ubuntu patched two local libvirt flaws: a possible code-execution overflow and a TPM log symlink bug.
36
Vulnerability2 · 1 read
CVE-2026-77159
Symlink-following chown flaw in libvirt swtpm logs
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A local symbolic-link following flaw (CWE-61) was found in libvirt’s qemuTPMEmulatorPrepareHost() function, which performs a path-based chown() on the swtpm logfile without checking whether that path is a symlink. A local attacker who already has access to the swtpm account can replace the logfile with a symlink so that libvirtd, running as root, changes ownership of an arbitrary file to the swtpm user. The result is a high integrity impact with no direct confidentiality or availability impact (CVSS 3.1 base score 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Systems running libvirt with the QEMU TPM emulator (swtpm) are in scope; Red Hat assigned the CVE and Ubuntu published USN-8831-1 for its libvirt packages. No public proof-of-concept is known, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog.
What to do: Install the libvirt security updates from your Linux vendor, including the packages covered by Ubuntu USN-8831-1 and the matching Red Hat or other distribution errata, once they are available for your release. Until then, tightly restrict access to the swtpm account and check swtpm log paths for unexpected symlinks and files whose ownership was changed to the swtpm user. The issue is local only and needs an existing swtpm-level foothold.
| Product | Affected |
|---|---|
| libvirt project (assigned by Red Hat) libvirt | — |
| Canonical (Ubuntu) libvirt packages | — |
Estimated exposure
largeOn the order of 100,000+ libvirt/KVM hosts, with a smaller subset using swtpm — libvirt is the standard KVM/QEMU management stack on RHEL, Ubuntu, Debian, and SUSE and is widely used on enterprise and OpenStack hosts, so affected installations are plausibly in the hundreds of thousands, but only the subset that uses…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
- Weakness
- CWE-61
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N