The vulnerability in attr before version 2.6.0 allows local attackers to perform symlink traversal attacks by substituting a symbolic link for a pathname component during directory traversal by getfattr or during backup restoration by setfattr. When these utilities are run by privileged processes on attacker-controlled paths, the attacker can redirect file attribute operations to arbitrary files, resulting in local privilege escalation. The issue is classified under CWE-59 (Improper Link Resolution Before File Access). Red Hat's advisory confirms the vulnerability and provides updated RPM packages (attr-2.6.0-9.1.hum1 and related) as a fix. No mitigation other than upgrading is currently recommended due to lack of effective alternative mitigations.

An attacker with local access who can control a pathname component can exploit this vulnerability to escalate privileges by causing privileged processes to follow symbolic links to arbitrary files during getfattr or setfattr operations. This can lead to unauthorized reading or modification of files and bypass of security mechanisms. The vulnerability has a CVSS 4.0 score of 8.4 (high severity) reflecting local attack vector, low complexity, and high confidentiality and integrity impact. There are no known exploits in the wild at this time.

Red Hat has released updated packages for attr (version 2.6.0-9.1.hum1) that fix this vulnerability. Users should upgrade to these fixed versions to remediate the issue. No effective mitigations other than applying the official patch are currently available or recommended. Monitoring or other workarounds do not meet Red Hat's criteria for mitigation. Users should consult the Red Hat advisory for detailed update instructions.