Threats Tagged 'cve-2026-63622'

A vulnerability in the libvirt library allows a local attacker running as the confined swtpm user to escalate privileges by exploiting a symlink-following flaw. The attacker can trick the root-level libvirt daemon into changing ownership of arbitrary files to the swtpm user, resulting in privilege escalation. This affects certain versions of libvirt used in Red Hat and Ubuntu distributions. Mitigation includes removing the <tpm> device from domain XML if virtual TPM functionality is not required. A fix is available from Red Hat upstream.

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.