Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-77159
5.5 MEDIUM
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): None (N)
  • Integrity (I): High (H)
  • Availability (A): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Confidentiality (MC): None (N)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): None (N)
created 1 week, 2 days ago Activity log
  • Created suggestion 1 week, 2 days ago
Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

Affected products

libvirt
virt:rhel/libvirt

Matching in nixpkgs

pkgs.libvirt

Toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes

  • nixos-unstable -
  • nixos-26.05 -

pkgs.libvirt-dbus

libvirt D-Bus API binding

  • nixos-unstable -
    • nixos-unstable-small 1.4.1
  • nixos-26.05 -
    • nixos-26.05-small 1.4.1

pkgs.libvirt-glib

Wrapper library of libvirt for glib-based applications

  • nixos-unstable -
    • nixos-unstable-small 5.0.0
  • nixos-26.05 -
    • nixos-26.05-small 5.0.0

Package maintainers