EUVD-2026-24990
GHSA-x4mc-mqm7-gg39
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.
AnalysisAI
Time-of-check-time-of-use (TOCTOU) vulnerability in uutils coreutils mv utility during cross-device file moves allows local attackers with directory write access to manipulate extended attributes (xattrs) on destination files by swapping files between sequential path-based system calls, potentially causing security labels like SELinux attributes or file capabilities to be applied inconsistently. CVSS 4.7 (local, high complexity) with confirmed vulnerability reported by Canonical; CISA SSVC assessment indicates non-automatable exploitation with partial technical impact.
Technical ContextAI
The vulnerability resides in the extended attribute preservation logic used during cross-device move operations in the mv utility. When moving files across filesystems, uutils coreutils performs multiple separate system calls to preserve xattrs-each call independently resolves the file path to its inode. This multi-call approach creates a window during which a local attacker with write permissions to the directory can replace or swap files, causing subsequent system calls to operate on different inodes than intended. The underlying issue is classified as CWE-367 (Time-of-check Time-of-use), a race condition where the time between permission/state verification and actual file operation allows an attacker to modify filesystem state. The affected product is uutils coreutils (CPE: cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:*), a Rust-based reimplementation of GNU coreutils utilities.
RemediationAI
Patch availability and exact fix version are not specified in available data; contact uutils coreutils maintainers or monitor the GitHub repository (https://github.com/uutils/coreutils/issues/10014) for a patched release. As an interim compensating control, system administrators can restrict directory write permissions to trusted users only, reducing the attacker surface to local accounts with elevated privileges. Additionally, enable SELinux or AppArmor policy enforcement to detect or prevent unauthorized file attribute manipulation, though this does not eliminate the race condition itself. Monitor filesystem operations during cross-device moves using auditd rules targeting mv execution and xattr syscalls (setxattr, getxattr, listxattr) to detect suspicious timing patterns. For defense-in-depth, run uutils coreutils in restricted containers with minimal write-accessible directories or use read-only mounts where possible, accepting the trade-off of reduced functionality for cross-device move operations.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today