This vulnerability in MRTG arises from improper link resolution before file access (CWE-59). When the MRTG daemon runs as root and subsequently drops privileges, an attacker with low privileges can pre-place or influence a symbolic link in the PID file path. This causes the root process to inadvertently change the ownership of arbitrary existing files to the daemon user. The vulnerability can be exploited locally to escalate privileges by manipulating file ownership, compromising confidentiality and integrity of files. The CVSS 3.1 base score is 7.1 (high severity) with local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact. No official patch or fix is currently confirmed by Red Hat. The vendor advisory recommends mitigation by avoiding starting MRTG as root with the --daemon option, running MRTG as an unprivileged user, or ensuring strict ownership and permissions on the PID file and its directory to prevent untrusted user influence.

A local, low-privileged attacker can exploit this vulnerability to escalate privileges by causing the MRTG daemon running as root to change ownership of arbitrary files. This can lead to unauthorized access or modification of sensitive files, impacting confidentiality and integrity. There is no impact on availability. No known exploits in the wild have been reported.

Red Hat advises not to start the MRTG daemon as root with the --daemon option. Instead, configure MRTG to run directly as an unprivileged user. If running as root is necessary, ensure the PID file and its directory are owned by root and not writable by unprivileged users. Prevent untrusted users from influencing the --pid-file path. Changes to service configuration may require a service restart. No official patch or fix is currently confirmed; check the vendor advisory for updates.