A symlink-following vulnerability exists in libvirt's virFileChownFiles() function on Red Hat Enterprise Linux 10, exploitable by a local attacker running as the confined swtpm user. By planting a symbolic link in the swtpm state directory, the attacker can trick the root-level libvirt daemon into changing ownership of arbitrary files to the swtpm user, enabling privilege escalation from the swtpm sandbox to root-level file ownership control. The vulnerability is classified as CWE-59 (Improper Link Resolution Before File Access). The vendor advisory recommends removing the <tpm> device definition from the domain XML configuration to prevent libvirt from spawning swtpm processes and invoking the vulnerable function, if vTPM functionality is not needed. For domains requiring vTPM, an upstream fix should be prioritized. The CVSS v3.1 score is 7.8 (High) with local attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with local access running as the confined swtpm user can escalate privileges to gain root-level file ownership control by exploiting the symlink-following flaw. This can lead to unauthorized modification or control of files at the root level, potentially compromising system confidentiality, integrity, and availability.

If virtual Trusted Platform Module (vTPM) functionality is not required, remove the <tpm> device definition from the domain XML configuration to prevent the vulnerable code path from being reached. This stops libvirt from spawning swtpm processes and calling the vulnerable virFileChownFiles() function. For domains that require vTPM, this mitigation is not applicable and applying the upstream fix should be prioritized. No official patch version is currently stated; check the vendor advisory for updates.