EUVD-2026-24979
GHSA-3wfc-mgpm-9rq6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are_files_identical function opens and reads from both input paths to compare content without first verifying if the paths refer to regular files. If an input path is a FIFO or a pipe, this pre-read operation drains the stream, leading to silent data loss before the actual comparison logic is executed. Additionally, the utility may hang indefinitely if it attempts to pre-read from infinite streams like /dev/zero.
AnalysisAI
The comm utility in uutils coreutils drains FIFO and pipe streams before performing file comparison due to premature data consumption in the are_files_identical function, causing silent data loss and potential indefinite hangs on infinite streams. Local authenticated users can trigger this vulnerability to corrupt or lose data in piped workflows, affecting the integrity of command-line data processing chains.
Technical ContextAI
The comm utility is a standard Unix text comparison tool. The vulnerability exists in the are_files_identical function, which reads from both input paths to compare file content before verifying whether those paths refer to regular files (CWE-20: Improper Input Validation). When given FIFO (named pipe) or pipe file descriptors as input, this premature read operation fully drains the stream, discarding data that the actual comparison logic never sees. This is problematic because FIFOs and pipes are sequential, non-seekable streams; once read, the data is consumed and unavailable. Additionally, attempting this operation on infinite streams like /dev/zero causes indefinite blocking, as the pre-read has no termination condition. The affected CPE cpe:2.3:a:uutils:coreutils:*:*:*:*:*:*:*:* indicates all versions prior to the fix are vulnerable.
RemediationAI
Upgrade uutils coreutils to version 0.6.0 or later, which includes the fix merged in pull request 9545 (https://github.com/uutils/coreutils/pull/9545). The patch adds file-type validation to the are_files_identical function to verify that inputs are regular files before performing pre-read operations, preventing data drainage from FIFOs and pipes. If immediate upgrade is not feasible, avoid piping data directly into comm; instead, use temporary regular files or process substitution with explicit regular-file storage as an intermediate step. This workaround has minimal performance overhead for small to medium datasets but may increase disk I/O and storage usage for large streams.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attacker
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today