CVE-2026-77179

Executive Summary

CVE-2026-77179 is a link-following (symlink) vulnerability, classified CWE-59, in the virtio-fs host server component used by Docker Sandboxes on macOS. Because the host-side server reopens an unlinked file from a stored path without re-validating each parent path component, a malicious guest can substitute a parent directory with a symlink, escape the shared workspace boundary, and read or modify arbitrary host files with the privileges of the VMM user — with a credible path to host code execution. Impact is confined to macOS hosts running Docker Sandboxes with virtio-fs shared mounts, but within that population the confidentiality, integrity, and availability impact is high and the security scope crosses a trust boundary (guest → host).

Technical Analysis

The vulnerable component is the virtio-fs host server that backs shared-filesystem mounts inside Docker Sandboxes on macOS. virtio-fs is a paravirtualized filesystem protocol: a guest VM issues FUSE-style requests over a virtqueue, and a cooperating process on the host (the virtio-fs server, typically virtiofsd) services those requests by performing the actual filesystem operations against a directory tree that has been explicitly exported to the guest as a "shared workspace."

The security model depends entirely on the host server never operating outside that exported tree. That containment is normally enforced through a set of defensive patterns:

1. Path confinement / export-root checking — resolving each guest-supplied path relative to the export root and refusing operations whose canonical target escapes the root.
2. O_NOFOLLOW-style open semantics — refusing to traverse a symlink on the final path component (and, critically, on parent components) when the operation is scoped to the shared directory.
3. File-descriptor-oriented, TOCTOU-safe operations — resolving paths to handles (openat-family with O_NOFOLLOW / RESOLVE_* flags, or file-descriptor-relative operations) rather than re-resolving the same path string repeatedly.

CVE-2026-77179 is a breakdown of pattern (2)/(3) in a specific, well-known corner of filesystem security: the "reopen an unlinked file from a stored path" sequence. The NVD description states that the host server "improperly follows symlinks when reopening an unlinked file from a stored path." The mechanism this describes is:

• The guest unlinks (or causes to be unlinked) a file inside the export.
• The host server, holding a stored path string for that now-unlinked file, attempts to reopen it to complete the operation.
• During that re-resolution the path is walked again from the root, and parent components are followed without symlink protection.
• A malicious guest thus "replaces a parent directory with a symlink," redirecting the re-resolution to an arbitrary host location.
• The server then performs the requested read/write against the redirected target as the VMM user, escaping the shared workspace.

The critical property is the trust-boundary crossing: the guest is untrusted, the VMM/host server process is the security boundary, and a link-following flaw lets a guest make the boundary process perform file I/O outside the export. This is a classic TOCTOU-and-link-follow composition — the re-lookup of a previously validated path is where the isolation guarantee is lost.

Weakness class: CWE-59 — Improper Link Resolution Before File Access ('Link Following'). The NVD description explicitly names "reopening an unlinked file from a stored path," "replace a parent directory with a symlink," "escape the shared workspace," and "read or modify arbitrary host files as the VMM user, potentially achieving host code execution." No public CVE-specific function names, class names, URL endpoints, or API parameters are present in the supplied NVD description; consequently this report does not name any host-server internal routines. Any implementation-level identifiers would be fabrication and are therefore omitted.

Attack surface: the virtio-fs shared mount path (guest→host filesystem RPC), reachable by any process inside the sandboxed guest, including a compromised container or malicious guest image. No authentication is required beyond the ability to issue filesystem operations inside the shared workspace.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-77179 (POC_STATUS: None; EPSS 0.00160, 5.6th percentile — low near-term exploitation likelihood). The chain below is inferred from the vulnerability class (CWE-59, link following during reopen of an unlinked file) and from the mechanism stated verbatim in the NVD description. Specific host-server function names are deliberately not supplied because none are given in the source data.

1) Reconnaissance / target identification The attacker already controls a guest (malicious workload/container image, or post-compromise code execution inside a sandboxed guest) on a macOS host where Docker Sandboxes is configured with one or more virtio-fs shared mounts. The attacker maps the shared workspace layout and identifies the operation the host server performs on files it has stored a path for. Target identification is passive; no special privileges inside the guest are required.

2) Triggering the flaw class (link following on reopen) The attacker arranges for the host server to enter the unlink-then-reopen sequence:

• Create/identify a file in the shared workspace whose handling causes the host server to store its path and later reopen it.
• As part of the same sequence, unlink the file (or the relevant path component).
• Before or during the reopen, replace a parent directory in the stored path with a symlink pointing outside the export (e.g., to a sensitive host directory).
• When the server re-resolves the stored path to reopen the unlinked file, it follows the substituted parent-directory symlink and operates on the attacker-chosen host target instead of the in-export file.

The essential pre-condition is a race/timing window between unlink and reopen, which is why the attack benefits from repeated attempts or from any interface that lets the attacker control ordering of the sequence.

3) Payload/execution method (at the class level) This is not a memory-corruption or injection bug; exploitation is filesystem-operation redirection. The attacker does not need to craft a code payload — the "payload" is the act of the boundary process reading or modifying a host file of the attacker's choosing under the stored-path reopen primitive. At host-code-execution potential, the class of technique is: escalate a redirect primitive on privileged files into a host execution path (the description states "potentially achieving host code execution" without naming the specific mechanism; we therefore do not fabricate one).

4) Post-exploitation impact With host files read/write as the VMM user, an attacker can exfiltrate host data, tamper with host-configuration files, and — per the description — potentially reach host code execution. Because the write is performed by the host boundary process, the sandbox isolation guarantee (guest cannot affect host) is fully broken, and any later workload on the same host sharing that VMM context can be affected.

Impact Assessment

• Confidentiality (High, C:H): arbitrary host files readable as the VMM user escape the shared workspace.
• Integrity (High, I:H): the same primitive permits arbitrary host file modification as the VMM user.
• Availability (High, A:H): host file modification can disrupt or destroy host state; the description allows for host code execution impact.
• Attack Vector (L, Local): the exploit originates from a guest (local to the sandbox), not over a network service.
• Attack Complexity (H, AC:H): exploitation depends on the unlink/reopen timing and on controlling the parent component replacement — a race/serialization condition, hence HIGH.
• Privileges Required (L, PR:L): code execution inside a guest is a low baseline; no host account is needed.
• User Interaction (N, UI:N): no victim host user action required.
• Scope (C, S:C): the vulnerable component (guest-facing virtio-fs server) impacts resources beyond its own security scope (the host filesystem and potentially host execution).

Business impact: any multi-tenant or untrusted-workload use of Docker Sandboxes on macOS where guest isolation is the primary control. Blast radius is limited to macOS hosts running vulnerable Docker Sandboxes with virtio-fs shares — but for those hosts the isolation control is exactly what fails, so the effective blast radius is the host user's full reachable file set. CVSS is not published (NVD shows N/A); the vector above is an analytical estimate consistent with the published description and must not be treated as a vendor-assigned score.

Detection Guidance

Detection strategy: the exploit leaves low-level filesystem artifacts (symlink creation, unlink/reopen sequences, unexpected access to host paths by the VMM process) and no network signature. The rules below are behavioral/telemetry-oriented and are intentionally generic to the CWE-59 mechanism rather than to any POC.

Sigma Rule

title: Potential virtio-fs Shared Workspace Escape via Symlink Link Following (CVE-2026-77179)
id: 8f3c1d92-7a41-4b0e-9c2f-6d5e8a1b4c70
status: experimental
description: Detects macOS DTrace/Unified Log or endpoint telemetry indicating a VMM/virtio-fs process accessing host paths after symlink substitution in a shared workspace, consistent with CWE-59 link following.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77179
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1611
  - cve.2026.77179
logsource:
  product: macos
  category: process_creation
detection:
  selection_proc:
    Image|endswith:
      - '/virtiofsd'
      - '/docker'
      - '/com.docker'
  selection_path:
    CommandLine|contains:
      - 'shared'
      - 'virtiofs'
  selection_link:
    CommandLine|contains:
      - 'ln -s'
      - 'symlink'
      - 'unlink'
  condition: selection_proc and selection_path and selection_link
falsepositives:
  - Legitimate build tooling creating symlinks inside a shared workspace
  - Package managers resolving symlinked caches within the export
level: medium

YARA Rule

rule CVE_2026_77179_VirtioFS_Symlink_Escape
{
    meta:
        author = "valtersit.com"
        description = "Detects references to virtio-fs shared workspace symlink/link-following escape patterns (CVE-2026-77179, CWE-59)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77179"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "virtio-fs" ascii nocase
        $b = "virtiofsd" ascii nocase
        $c = "shared workspace" ascii nocase
        $d = "O_NOFOLLOW" ascii
        $e = "symlink" ascii nocase
        $f = "reopen" ascii nocase
    condition:
        (uint32(0) == 0xFEEDFACE or uint32(0) == 0xFEEDFACF or uint32(0) == 0xCAFEBABE)
        and 2 of ($a, $b, $d, $f)
        and 1 of ($c, $e)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-77179 Possible Docker VirtioFS Guest-Host Escape Attempt (workspace symlink path traversal)"; flow:established,to_server; content:"virtiofs"; nocase; content:"symlink"; nocase; distance:0; within:256; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; sid:202677179; rev:1; reference:cve,2026-77179; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: virtio-fs traffic is normally intra-host (guest↔host), so this rule is most useful on hosts that forward guest vhost-user/virtio transport for monitoring, or in lab ranges. It is a secondary signal to host filesystem telemetry.

Elastic Detection

process where event.type == "start" and
  process.name in ("virtiofsd", "docker", "com.docker.virtualization") and
  process.command_line : "*virtiofs*" and
  process.command_line : ("*ln -s*" or "*symlink*" or "*unlink*")

Process-binary behavioral variant for hosts that do not ship the command line:

file where event.action in ("creation", "modification", "deletion", "access") and
  file.path : ("*/shared/*" or "*virtiofs*") and
  process.name in ("virtiofsd", "docker")

Splunk SPL Query

index=os sourcetype="macos:unified" OR sourcetype="macos:endpoint"
(process="*virtiofsd*" OR process_name="*virtiofsd*" OR command="*virtiofs*")
(EventMessage="*symlink*" OR EventMessage="*ln -s*" OR EventMessage="*unlink*" OR EventMessage="*O_NOFOLLOW*")
| eval risk=if(match(EventMessage,"(?i)(symlink|ln -s)"),2,1)
| stats count sum(risk) as risk_score values(EventMessage) as messages by host, process, user
| where count >= 3
| sort - risk_score

Wazuh OSSEC Rule

<group name="docker,cve_2026_77179,">
  <rule id="100771" level="12">
    <decoded_as>json</decoded_as>
    <field name="process">virtiofsd|docker|com.docker.virtualization</field>
    <field name="message">(?i)(symlink|ln -s)</field>
    <field name="message">(?i)(shared|virtiofs|unlink)</field>
    <description>CVE-2026-77179: Possible virtio-fs shared workspace escape via symlink link following (CWE-59)</description>
    <mitre>
      <id>T1611</id>
    </mitre>
    <group>cve_2026_77179,pci_dss_10.2.4,</group>
  </rule>
</group>

Tuning note: legitimate container/build tooling generates symlinks inside shared workspaces. Baseline symlink creation volume and expected path prefixes per host before enabling this rule; scope alerts to symlink creation whose target resolves outside the declared export root, and to the VMM/virtio-fs process opening host paths after such an event.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, OSV, asserts a fix; not independently confirmed). No vendor advisory, fixed version string, or commit hash is present in the supplied data, and the tracked OSV revision is listed as unfixed in the affected branch. Do not treat "patched" as established.

1) Immediate mitigations (while patch status is unverified)

• Disable virtio-fs shared mounts for any sandbox that must be treated as untrusted, and switch that workload to a non-shared or network-mounted data path.
• Treat guest isolation as non-authoritative on affected macOS hosts: run untrusted guests only on a dedicated, disposable host account (least-privilege VMM user) to bound the reachable file set if the boundary is crossed.
• Harden the host's sensitivity: remove or encrypt high-value files from the VMM user's reachable paths; avoid running the sandbox under an over-privileged host account.
• If parity options exist (e.g., 9p / alternative share back-ends), evaluate whether they are equally affected before assuming any given back-end is safe — this report only establishes virtio-fs impact from the NVD description.
• Monitor for the detection signals above and watch Docker/OSV release channels for a confirmed fix.

2) Patch/upgrade steps

• Track the official Docker security advisory page and release notes for Docker Sandboxes on macOS; the sole current patch source is OSV, which must be corroborated.
• When a fixed Docker Sandboxes build is published, upgrade to it, re-create sandbox VMs so virtio-fs server processes restart on the patched code, and re-enable shared mounts only after verification.
• Re-verify the fix by confirming symlink/reopen behavior is contained in a test sandbox after upgrade.

3) Long-term hardening

• Enforce least privilege for the VMM/host-server user; never run the sandbox host components as a broadly privileged account.
• Prefer fd-relative / O_NOFOLLOW-based access patterns and pin-the-target (open-once, operate-on-handle) semantics for shared-workspace services; treat re-resolution of stored paths as a threat.
• Adopt a policy of reproducing link-following (CWE-59) test cases — including parent-directory symlink substitution and unlink/reopen races — in CI for any virtualization share layer.
• Segment hosts running untrusted guests and log host-side file access from VMM processes to a tamper-resistant store.

References

1. NVD — CVE-2026-77179: https://nvd.nist.gov/vuln/detail/CVE-2026-77179
2. MITRE CWE-59 — Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
3. MITRE ATT&CK T1611 — Escape to Host: https://attack.mitre.org/techniques/T1611/
4. OSV — CVE-2026-77179 entry (sole, unconfirmed patch source; assert-category "CLAIMED"): https://osv.dev/vulnerability/CVE-2026-77179
5. Docker Security Advisories (canonical vendor channel for Docker Sandboxes / virtio-fs fixes): https://docs.docker.com/security/

Threat actor / ITW note: No evidence of exploit-in-the-wild, no public PoC, and no CISA KEV listing are indicated in the supplied data (KEV: NO; PoC: None; Exploit Code: None). EPSS 0.00160 (5.6th percentile) indicates low predicted near-term exploitation. This is a latent isolation-integrity defect: its severity stems from the trust-boundary crossing it creates, while observed weaponization appears absent as of the data provided. Specific host-server routine names are intentionally omitted because the NVD description does not disclose them.