{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77159", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-20T14:42:32.943Z", "datePublished": "2026-09-11T10:32:29.772Z", "dateUpdated": "2026-09-15T15:40:56.022Z"}, "containers": {"cna": {"title": "Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libvirt", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:10"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libvirt", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:6"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libvirt", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "virt:rhel/libvirt", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:8"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libvirt", "defaultStatus": "affected", "cpes": ["cpe:/o:redhat:enterprise_linux:9"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-77159", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531811", "name": "RHBZ#2531811", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://gitlab.com/libvirt/libvirt/-/work_items/909"}], "datePublic": "2026-09-11T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-61", "description": "UNIX Symbolic Link (Symlink) Following", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-61: UNIX Symbolic Link (Symlink) Following", "workarounds": [{"lang": "en", "value": "On Red Hat Enterprise Linux, SELinux in enforcing mode (the default) confines the swtpm process to the swtpm_t domain, which restricts the creation of symlinks to arbitrary file types and limits the scope of any ownership change, reducing the practical impact of this flaw. Ensure SELinux is not disabled or set to permissive mode."}], "timeline": [{"lang": "en", "time": "2026-09-11T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-11T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Suraj Theekshana for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-11T10:41:54.715Z"}, "x_generator": {"engine": "cvelib 1.8.0"}, "x_gcve": [{"vulnId": "CVE-2026-77159", "recordType": "advisory"}]}, "adp": [{"references": [{"url": "https://gitlab.com/libvirt/libvirt/-/work_items/909", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T15:39:11.306501Z", "id": "CVE-2026-77159", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T15:40:56.022Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-77159", "date": "2026-10-06", "epss": "0.00162", "percentile": "0.04836"}, "microsoft_vex": {"current_release_date": "2026-09-29T01:45:22.000Z", "cve": "CVE-2026-77159", "id": "msrc_CVE-2026-77159", "initial_release_date": "2026-09-17T01:02:55.000Z", "product_status:fixed": "1", "product_status:known_affected": "1", "source": "Microsoft CSAF VEX", "status": "final", "title": "Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink", "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-77159.json", "version": "3"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-77159\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-09-11T11:16:54.677\",\"lastModified\":\"2026-09-16T19:42:43.623\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libvirt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libvirt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libvirt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"virt:rhel/libvirt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"libvirt\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-15T15:39:11.306501Z\",\"id\":\"CVE-2026-77159\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-61\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-77159\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2531811\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.com/libvirt/libvirt/-/work_items/909\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://gitlab.com/libvirt/libvirt/-/work_items/909\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}", "redhat_vex": {"aggregate_severity": "Moderate", "current_release_date": "2026-09-11T11:06:27+00:00", "cve": "CVE-2026-77159", "id": "CVE-2026-77159", "initial_release_date": "2026-09-11T00:00:00+00:00", "product_status:known_affected": "131", "product_status:known_not_affected": "6", "source": "Red Hat CSAF VEX", "status": "final", "title": "libvirt: Unsafe chown in qemuTPMEmulatorPrepareHost() allows arbitrary file ownership change via symlink", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77159.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-77159\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-15T15:39:11.306501Z\"}}}], \"references\": [{\"url\": \"https://gitlab.com/libvirt/libvirt/-/work_items/909\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-15T15:39:27.229Z\"}}], \"cna\": {\"title\": \"Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank Suraj Theekshana for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"libvirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"libvirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"libvirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"virt:rhel/libvirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"libvirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-11T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-09-11T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-09-11T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-77159\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2531811\", \"name\": \"RHBZ#2531811\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://gitlab.com/libvirt/libvirt/-/work_items/909\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"On Red Hat Enterprise Linux, SELinux in enforcing mode (the default) confines the swtpm process to the swtpm_t domain, which restricts the creation of symlinks to arbitrary file types and limits the scope of any ownership change, reducing the practical impact of this flaw. Ensure SELinux is not disabled or set to permissive mode.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-61\", \"description\": \"UNIX Symbolic Link (Symlink) Following\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-09-11T10:41:54.715Z\"}, \"x_redhatCweChain\": \"CWE-61: UNIX Symbolic Link (Symlink) Following\"}}", "cveMetadata": "{\"cveId\": \"CVE-2026-77159\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-15T15:40:56.022Z\", \"dateReserved\": \"2026-08-20T14:42:32.943Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-09-11T10:32:29.772Z\", \"assignerShortName\": \"redhat\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}