The rhc-canonical-facts.service unit runs as root and writes to a file inside a directory owned by an unprivileged system user. The unit does not verify that the target file is not a symbolic link, allowing a local attacker with control of the privileged yggdrasil account to point the file to an arbitrary location. Once the symlink is resolved, the attacker gains ownership of the target file and can subsequently obtain full root privileges by abusing the privileged account key space. This flaw directly results in privilege escalation from a compromised user to root.

Red Hat Enterprise Linux 10, 7, 8 and 9 are affected because the rhc-canonical-facts.service unit shipped with these releases contains the vulnerable logic. Any installation of rhc on these platforms that has not been updated after the advisory is vulnerable.

The vulnerability scores a CVSS of 6, indicating moderate severity. EPSS is not available, but the flaw is not currently listed in the CISA KEV catalog. Exploitation requires a local attacker who already has compromised the privileged yggdrasil system service account; once that condition is met, the attacker can manipulate file ownership and elevate to root. The risk is therefore significant within environments where the yggdrasil account is at risk of compromise.