Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-77159: A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
Fixed packages 49
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | libvirt | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-client | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-client-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-client-qemu | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-common | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-common-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-config-network | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-config-nwfilter | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-interface | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-interface-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-network | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-network-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-nodedev | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-nodedev-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-nwfilter | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-nwfilter-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-qemu | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-qemu-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-secret | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-secret-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-storage | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-storage-core | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-storage-core-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-storage-disk | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-storage-disk-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-storage-logical | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-driver-storage-logical-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-kvm | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-lock | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-lock-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-log | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-log-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-plugin-lockd | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-plugin-lockd-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-proxy | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-proxy-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-daemon-qemu | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-debugsource | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-devel | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-docs | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-libs | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-libs-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-nss | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-nss-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-ssh-proxy | 0:12.0.0-3.amzn2023.0.3 |
| Amazon Linux · 2023 | libvirt-ssh-proxy-debuginfo | 0:12.0.0-3.amzn2023.0.3 |
Vulnerabilities 1
-
Medium 5.5
Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile w…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-77159.html