This vulnerability involves a symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function on Red Hat Enterprise Linux 10. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links, allowing a local attacker with swtpm account access to replace the logfile with a symlink. This causes libvirtd, running with root privileges, to transfer ownership of arbitrary files to the swtpm user. The flaw has a CVSS v3.1 base score of 5.5 (medium severity) with an integrity impact but no confidentiality or availability impact. Red Hat advises ensuring SELinux is enabled and enforcing, which confines the swtpm process and limits the practical impact of this issue. No explicit patch or fixed version is stated in the advisory; mitigation relies on SELinux enforcement.

The vulnerability allows a local attacker with swtpm account access to cause libvirtd (running as root) to change ownership of arbitrary files to the swtpm user via a symlink attack on the swtpm logfile. This impacts system integrity but does not affect confidentiality or availability. The practical impact is reduced if SELinux is enabled and enforcing, as it restricts symlink creation and ownership changes by the swtpm process.

Red Hat recommends ensuring SELinux is enabled and set to enforcing mode (the default) to confine the swtpm process to the swtpm_t domain. This restricts the creation of symlinks to arbitrary file types and limits ownership changes, thereby reducing the impact of this flaw. No official patch or fix is currently stated; users should verify SELinux status and avoid disabling or setting it to permissive mode.