EUVD-2026-24996
GHSA-2m8x-mvfx-gwgj
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.
AnalysisAI
The cp utility in uutils coreutils exposes sensitive file contents through a race condition where destination files are created with overly permissive umask-derived permissions before being restricted to their final restrictive mode. A local authenticated attacker can open the file during this narrow window to obtain a valid file descriptor that remains readable even after permissions are tightened, bypassing intended access controls. CVSS 4.7 with high confidentiality impact but limited exploitability due to high attack complexity and moderate SSVC rating.
Technical ContextAI
The vulnerability stems from a Time-of-Check-Time-of-Use (TOCTOU) race condition in the file creation process, classified under CWE-367 (Time-of-check Time-of-use). The cp utility creates destination files with default umask permissions (typically 0644 for world-readable) before applying the intended restrictive permissions (such as 0600 for owner-only). In Unix-like systems, once a file descriptor is opened by a process, the descriptor remains valid and retains its original access permissions regardless of subsequent changes to the file's mode bits. The affected product is uutils coreutils (CPE: cpe:2.3:a:uutils:coreutils), a Rust-based implementation of POSIX core utilities that aims to provide GNU coreutils replacements.
RemediationAI
Apply a vendor-released patch once available by updating uutils coreutils to a patched version (specific fix version number not yet published per available data). The recommended mitigation involves modifying the cp utility's implementation to atomically create destination files with restrictive permissions from the outset, eliminating the race condition window entirely. Alternative compensating controls include restricting local shell access to trusted users only via proper access controls and file permissions (trade-off: may limit legitimate administrative flexibility), monitoring file access patterns for suspicious concurrent opens during cp operations (trade-off: performance overhead), or using temporary file locations with pre-set restrictive permissions before copying content (trade-off: increases complexity and disk I/O). Until patches are released, audit systems to identify sensitive files being copied via cp and consider manual verification of resulting file permissions post-copy. See upstream issue https://github.com/uutils/coreutils/issues/10011 for patch status updates.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attacker
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today