EUVD-2026-24988
GHSA-mj6p-44ch-cq69
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.
AnalysisAI
The mkdir utility in uutils coreutils creates directories with default umask-derived permissions (0755) before applying the requested mode via chmod, creating a race condition window where a directory intended to be private becomes briefly accessible to other local users. This affects uutils coreutils versions prior to 0.6.0 and requires local authenticated access to exploit, limiting real-world impact despite the CVSS score of 3.3.
Technical ContextAI
The vulnerability stems from a Time-of-Check-Time-of-Use (TOCTOU) race condition in the mkdir implementation. When the -m flag is used to specify directory permissions, the utility creates the directory with default umask-derived permissions (typically 0755, world-readable) and subsequently calls chmod to set the requested restrictive mode. In multi-user systems, an unprivileged local process can race to access the directory contents during this brief window before chmod is applied. The root cause is classified under CWE-367 (Time-of-check Time-of-use TOCTOU Race Condition), a common synchronization vulnerability in file operations. The affected product (uutils coreutils) is a Rust-based reimplementation of GNU coreutils utilities.
RemediationAI
Vendor-released patch: upgrade uutils coreutils to version 0.6.0 or later. The upstream fix (GitHub PR #10036) modifies mkdir to apply permissions atomically using the mode parameter in the mkdir system call itself, eliminating the TOCTOU window entirely. For environments unable to upgrade immediately, the primary compensating control is to restrict use of mkdir with -m flags to trusted administrators only by removing or restricting user access to the uutils coreutils mkdir binary via filesystem permissions (e.g., chmod 750 on the mkdir binary). This prevents unprivileged users from creating directories with custom permissions, though it may impact workflow if users legitimately need this functionality. Alternative mitigation for high-security deployments involves using AppArmor or SELinux policies to prevent concurrent access to the same directory paths during mkdir operations, but this adds significant operational complexity.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attacker
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today