The acl package prior to version 2.4.0 contains a symlink traversal vulnerability (CWE-59) in its libacl pathname-based functions such as acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file(). A local attacker who can create symbolic links in directories processed by privileged processes can exploit this flaw to redirect ACL read or write operations to arbitrary files or directories. This unauthorized redirection enables manipulation of access control lists and local privilege escalation. The vulnerability has a CVSS 4.0 score of 8.4 (high) and requires low privileges with no user interaction. Red Hat's advisory highlights that default file permissions and the fs.protected_symlinks sysctl (enabled by default on RHEL 7+) reduce the attack surface. Red Hat has issued security updates fixing this issue in acl version 2.4.0 for Red Hat Enterprise Linux 10 and related products.

Exploitation of this vulnerability allows a local attacker to escalate privileges by manipulating access control lists through symbolic link traversal. Attackers can redirect ACL operations to arbitrary files or directories, potentially bypassing security mechanisms and gaining unauthorized access or modification rights. The impact includes confidentiality and integrity compromise of files and directories controlled by ACLs. The vulnerability does not affect availability. The attack requires local access and the ability to create symbolic links in targeted directories.

Red Hat advises restricting unprivileged users from creating symbolic links in directories accessed by privileged processes using ACL functions. Enabling the fs.protected_symlinks sysctl (enabled by default on RHEL 7 and later) helps prevent symlink following in world-writable sticky directories unless the symlink owner matches the target owner. Applying the official security update to upgrade acl to version 2.4.0 or later fully addresses this vulnerability. Systems running affected versions should prioritize patching. Where patching is not immediately possible, apply the recommended mitigations to reduce risk.