CyberRota Analysis
AI-GeneratedA symlink-following vulnerability in the qemuTPMEmulatorPrepareHost() function of libvirt allows a local attacker with access to the swtpm account to exploit the chown() operation on the swtpm logfile. This could lead to the unintended transfer of ownership of arbitrary files to the swtpm user, potentially compromising system integrity. Organizations using libvirt should prioritize patching this vulnerability to mitigate risks associated with local privilege escalation.
Original NVD Description
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.