EUVD-2026-25028Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup (via fts_accpath) rather than binding the traversal and label application to the specific directory state encountered during traversal. Because these operations are not anchored to file descriptors, a local attacker with write access to a directory tree can exploit timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories. This vulnerability breaks the hardening expectations for SELinux administration workflows and can lead to the unauthorized modification of security labels on sensitive system objects.
AnalysisAI
Time-of-Check to Time-of-Use (TOCTOU) race condition in the chcon utility of uutils coreutils allows local attackers with directory write access to redirect recursive security label operations to unintended files or directories via symbolic link or rename races, potentially compromising SELinux security controls. The vulnerability affects versions prior to 0.8.0 and requires low privileges and high attack complexity to exploit, making it a moderate-severity issue with partial technical impact.
Technical ContextAI
The chcon utility is responsible for changing SELinux security context labels on files and directories. The vulnerability stems from how recursive operations resolve target paths using fresh path lookups via fts_accpath instead of maintaining file descriptor anchors throughout the traversal. This implementation pattern is susceptible to Time-of-Check to Time-of-Use (TOCTOU) race conditions as defined in CWE-367, where the state of a resource (file system path) can change between the moment it is checked and the moment the privileged operation is applied. An attacker with write access to the directory tree being traversed can exploit the window between path validation and label application by performing symbolic link injection or renaming operations, causing the security label modifications to be applied to files other than the originally intended targets.
RemediationAI
Vendor-released patch: upgrade uutils coreutils to version 0.8.0 or later. The patch addresses the TOCTOU vulnerability by implementing file descriptor anchoring during recursive traversal operations. Organizations using uutils coreutils should prioritize this upgrade in their next maintenance cycle, particularly if running chcon commands with elevated privileges on shared or untrusted file systems. Interim workarounds while patching is pending include restricting write access to directories being recursively relabeled (tighten directory permissions prior to chcon execution), avoiding recursive (-R) chcon operations on directories with untrusted write access, or temporarily disabling unprivileged user write access to target directories during privileged chcon operations-though these workarounds degrade administrative flexibility and are not long-term solutions.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today