The virFileChownFiles() function in libvirt silently follows symlinks when changing file ownership — a dangerous behavior when operating on directories writable by unprivileged users. The TPM state directory managed by swtpm is owned by the swtpm user (a 'confined' account), which means that user can create symlinks inside it. When the libvirt daemon later chowns files in that directory as root, it follows those symlinks and changes ownership of arbitrary files outside the TPM directory. This is a privilege escalation from the confined swtpm user to root.
This is not a bug in TPM code — it is a systemic failure in how libvirt's file ownership APIs encode security assumptions. The 'confined user' model created an illusion of isolation: developers (and reviewers) assumed that directories owned by a constrained user were safe for root-level operations. The virFileChownFiles() API never made its security contract explicit — it simply followed symlinks, trusting that the paths it touched were non-adversarial. When a developer focused on TPM correctness implemented state management, they had no reason to second-guess whether a 'confined' directory could contain malicious symlinks.
Check your systems: examine all virFile* functions that touch paths under /var/lib/libvirt/ or similar user-writable directories. Verify that any operation running as root explicitly rejects symlinks before operating on the target. Review your libvirt version — patches for this vulnerability add explicit symlink checks to virFileChownFiles(). If your version is older than the fix, treat any swtpm state directory as untrusted input to privileged operations.
The deeper question is whether this class of vulnerability should be prevented architecturally rather than patched reactively. Every function in libvirt that performs privileged operations on user-controlled paths represents a potential replay of this bug. The fix is correct, but without a formal threat model that treats 'confined user' directories as elevated-threat starting points rather than contained endpoints, similar vulnerabilities will continue to surface.