sos clean EUVD-2026-65492

Exploitation requires that an attacker supply a specially crafted tar archive and that a privileged user (typically root) processes that archive using the sos clean command. The sos clean process must have write access to the target path - since it commonly runs as root, no additional file permission barrier exists. The CVSS UI:R metric confirms that a human operator must actively invoke sos clean on the malicious archive; fully automated exploitation against systems without operator interaction is not possible. Non-default configurations or specific feature flags are not required - this affects the default sos clean extraction path on all RHEL 6-10 systems with the unpatched sos package installed. Exploitation is limited by the requirement that the attacker either have local access to deliver the archive or control an archive-delivery channel trusted by the target operator (e.g., a shared support portal or automated pipeline ingesting external sosreports).

The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a realistic threat model: the attacker crafts a malicious archive (no privileges required) and must induce a privileged user to process it with sos clean (UI:R). The local attack vector (AV:L) constrains automated scanning at internet scale, but in enterprise environments where sosreport archives are routinely shared with support teams or processed by automated pipelines, the effective barrier is lower than AV:L implies. The AC:L rating is accurate - archive crafting requires no special conditions once the technique is understood. The C:H rating is defensible because a well-crafted archive could overwrite cron jobs, sudoers, or SSH authorized_keys, achieving full system compromise including confidentiality. EPSS data was not provided in the input; without it, probabilistic exploitation frequency cannot be quantified. No KEV listing and no identified public POC reduce immediate urgency, though the GitHub issue (#4460) and PR (#4461) are public and sufficient for a competent attacker to reconstruct the technique. The highest real-world risk is in CI/CD or support workflows that automatically process untrusted sosreport archives as root.

An attacker with the ability to supply a sosreport tar archive to a system administrator persuades or tricks the administrator into running sos clean on the malicious archive as root. The archive contains a symlink member pointing to /etc and a subsequent file member under the same relative path; during extraction, sos clean follows the symlink and writes the attacker-controlled file content to /etc/cron.d/backdoor or /etc/sudoers.d/pwned, achieving persistent privilege escalation. The GitHub issue and PR are public, providing enough detail to reconstruct this technique without a standalone POC.