On a Tuesday in 2026, Daniel P. Berrangé via Devel wrote:
From: HE WEI（ギカク） <[email protected]>virFileChownFiles() selected entries with virFileIsRegular() (stat(), follows symlinks) and changed ownership with chown() (follows symlinks). A component that owns the target directory at a lower privilege (e.g. the swtpm/tss state directory) can plant a symlink to an arbitrary regular file and have the root caller chown that file. Use lstat() to skip non-regular entries and fchownat(..., AT_SYMLINK_NOFOLLOW) so a symlink final component is never followed. Fixes: CVE-2026-63622 Signed-off-by: HE WEI（ギカク） <[email protected]> [DB: use g_lstat instead of stat; use lchown instead of fchownat for portability; added comment] Signed-off-by: Daniel P. Berrangé <[email protected]> --- src/util/virfile.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
Reviewed-by: Ján Tomko <[email protected]> Jano
signature.asc
Description: PGP signature
