CVE-2026-112210
Description
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic link. A local attacker who has already compromised the privileged yggdrasil system service account can exploit this to gain ownership of arbitrary files, leading to privilege escalation to root.
Statement
This vulnerability is rated Moderate because exploitation requires prior compromise of the yggdrasil system service account, which is not directly accessible to unprivileged users. Additionally, SELinux in Enforcing mode limits the set of files reachable through the full exploit chain. Versions of rhc prior to 0.3.0 (shipped in RHEL 7, 8, and 9) do not include the vulnerable service file and are not affected.
Mitigation
Disable the rhc-canonical-facts timer to prevent automatic triggering of the vulnerable service:
systemctl stop rhc-canonical-facts.timer
systemctl disable rhc-canonical-facts.timer
Note that this will prevent rhc from updating canonical facts automatically. The rhc connect command will still trigger the service manually.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6 | N/A | 6 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | High | N/A | High |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Red Hat CVSS v3 Score Explanation
Requires code execution as yggdrasil service account (PR:L). No race condition — symlink is planted before service fires (AC:L). SELinux blocks shadow_t targets but systemd_unit_file_t and var_lib_t are reachable end-to-end (I:H). Target file content is truncated and overwritten (A:H). No direct data disclosure (C:N).
Acknowledgements
Red Hat would like to thank D.M Sithum Vihanga for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
