Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

ubuntu логотип

CVE-2026-63622

Опубликовано: 10 авг. 2026
Источник: ubuntu
Приоритет: medium
CVSS3: 7.8

Описание

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles() function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the swtpm user. This allows for privilege escalation from the swtpm sandbox to root-level file ownership control.

РелизСтатусПримечание
devel

not-affected

12.6.0-1ubuntu1
esm-infra-legacy/trusty

not-affected

code not present
esm-infra-legacy/xenial

not-affected

code not present
esm-infra/bionic

not-affected

code not present
esm-infra/focal

released

6.0.0-0ubuntu8.20+esm1
jammy

released

8.0.0-1ubuntu7.19
noble

released

10.0.0-2ubuntu8.16
resolute

released

12.0.0-1ubuntu5.3
upstream

released

12.6.0-1

Показывать по

РелизСтатусПримечание
devel

needs-triage

jammy

DNE

noble

DNE

resolute

needs-triage

upstream

needs-triage

Показывать по

7.8 High

CVSS3

Связанные уязвимости

CVSS3: 7.8
redhat
около 1 месяца назад

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

CVSS3: 7.8
nvd
24 дня назад

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

CVSS3: 7.8
debian
24 дня назад

A flaw was found in libvirt. A local attacker, specifically a process ...

CVSS3: 7.8
github
24 дня назад

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

7.8 High

CVSS3