REDHAT-BUG-2555474: Medium severity Red Hat rhc vulnerability

Published Oct 19, 2026

Updated

A symlink-following vulnerability was found in rhc-canonical-facts.service. The service runs as root and performs touch, chown yggdrasil:yggdrasil, and StandardOutput=truncate: on /var/lib/yggdrasil/canonical-facts.json — a path inside a directory owned by the unprivileged yggdrasil user (via StateDirectory=yggdrasil). None of these operations reject symlinks.

An attacker with code execution as yggdrasil can replace canonical-facts.json with a symlink to an arbitrary file. When the service triggers (daily timer or rhc connect), the target file's ownership is transferred to yggdrasil and its content is truncated and overwritten.

The service has no User= directive, no systemd sandboxing, and no confined SELinux domain (systemd-analyze security: 9.6 UNSAFE). On RHEL 10.2 with SELinux Enforcing, the full exploit chain was confirmed against varlibt and systemdunitfilet targets. The /etc/shadow path is blocked by SELinux (initt cannot open shadowt for StandardOutput), but targeting systemd unit files provides a path to root.

Introduced in rhc v0.3.0. Versions prior to 0.3.0 do not ship this service file.

External reference: PSIRTSUPT-25922

Affected Software

1 affected component

Red Hat rhc>=0.3.0

Event History

Oct 19, 2026

Data Sourced

via Red Hat·10:20 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems running rhc version 0.3.0 or later are exposed if an attacker can execute code as the unprivileged yggdrasil user. Versions earlier than 0.3.0 do not include the affected service file.

What causes the privileged file modification?

The attacker must replace /var/lib/yggdrasil/canonical-facts.json with a symlink to a chosen target. When rhc-canonical-facts.service runs, including through its daily timer or rhc connect, it follows that symlink as root, changes the target ownership to yggdrasil, and truncates and overwrites it.

Does SELinux prevent exploitation?

SELinux Enforcing blocked the demonstrated /etc/shadow target because init_t could not open shadow_t for StandardOutput. However, the complete exploit chain was confirmed on RHEL 10.2 against var_lib_t and systemd_unit_file_t targets, and overwriting systemd unit files can provide a route to root.

REDHAT-BUG-2555474: Medium severity Red Hat rhc vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What causes the privileged file modification?

Does SELinux prevent exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What causes the privileged file modification?

Does SELinux prevent exploitation?