EUVD-2026-24998
GHSA-67hp-f6hq-2h6g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.
AnalysisAI
The cp utility in uutils coreutils versions before 0.7.0 incorrectly handles recursive copy operations (-R flag) by converting character and block device nodes into regular files instead of preserving them via mknod, destroying device semantics and enabling denial of service through disk exhaustion or process hangs when unbounded device nodes are copied.
Technical ContextAI
The cp utility is a core file-copying command that supports recursive directory copying via the -R flag. Device nodes (/dev/null, /dev/zero, /dev/random, etc.) are special files that provide access to kernel device drivers and should be recreated as device nodes at the destination using mknod(2) system calls, preserving their character or block device properties and driver semantics. The uutils coreutils implementation incorrectly treats device nodes as regular stream sources, reading their contents into files at the destination. This violates POSIX cp semantics (CWE-706: Use of Incorrectly-Resolved Name or Reference) where device nodes must maintain their special file type. The issue affects all versions of uutils coreutils before 0.7.0 across all platforms where the cp command is compiled.
RemediationAI
Upgrade uutils coreutils to version 0.7.0 or later, which corrects the recursive copy behavior to properly preserve device nodes. No workaround exists for earlier versions that fully mitigates the risk; however, administrators can reduce exposure by restricting local user access to cp command execution (via sudo rules, AppArmor, or SELinux), avoiding recursive copies of directories containing device nodes, or using GNU coreutils (the reference implementation) as a drop-in replacement if uutils is not required for specific reasons. The patch is available at https://github.com/uutils/coreutils/pull/11163 and official advisory at https://github.com/uutils/coreutils/releases/tag/0.7.0.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attacker
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today