A flaw was found in libvirt. A local attacker, specifically a process running as the confined "swtpm" user, could exploit a symlink-following vulnerability in the "virFileChownFiles()" function. By planting a symbolic link within the "swtpm" state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the "swtpm" user. This allows for privilege escalation from the "swtpm" sandbox to root-level file ownership control.