REDHAT-BUG-2513065: High severity libvirt libvirt vulnerability
A symlink-following vulnerability was found in libvirt's virFileChownFiles() function in src/util/virfile.c. This function is called from src/qemu/qemutpm.c to change ownership of the swtpm state directory when starting a QEMU domain.
The function used stat() (via virFileIsRegular()) and chown(), both of which follow symlinks. A process running as the confined swtpm user (tss) can plant a symlink inside the swtpm state directory pointing to an arbitrary file. When the root-level libvirt daemon starts the next domain, it calls virFileChownFiles() which follows the symlink and chowns the target file to the tss user. This allows escalation from the swtpm sandbox to root-level file ownership control.
The fix replaces stat()/chown() with lstat()/lchown() to avoid following symlinks on the final path component.
Upstream fix: https://gitlab.com/libvirt/libvirt/-/commit/801160fd414ca2cc402bc01ead09b7ed4c3b8f5b
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 801160fd414ca2cc402bc01ead09b7ed4c3b8f5b - Compensating control
Prevent exploitation by ensuring the swtpm state directory contents cannot be manipulated by the confined swtpm (tss) user (e.g., ensure correct ownership/permissions and isolation so symlinks cannot be planted inside the swtpm state directory).
- Compensating control
As a defense-in-depth measure, restrict libvirt/QEMU access so that an attacker cannot influence or replace paths under the swtpm state directory that are later processed by libvirt’s virFileChownFiles() during QEMU domain startup.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2513065?
The severity of REDHAT-BUG-2513065 is classified as high with a score of 7.
What does REDHAT-BUG-2513065 affect?
REDHAT-BUG-2513065 affects the libvirt software, specifically the virFileChownFiles() function that deals with changing ownership of directories.
How do I fix REDHAT-BUG-2513065?
To fix REDHAT-BUG-2513065, update to the latest version of libvirt that addresses this symlink-following vulnerability.
What is the nature of the vulnerability in REDHAT-BUG-2513065?
REDHAT-BUG-2513065 is a symlink-following vulnerability that occurs in the virFileChownFiles() function of libvirt.
When was REDHAT-BUG-2513065 published?
REDHAT-BUG-2513065 was published on August 10, 2026.