uutils coreutils EUVD-2026-25004

Exploitation requires: (1) local system access with root or CAP_MKNOD capability to execute mknod, (2) an active SELinux policy in enforcing or permissive mode on the target system (unaffected on systems without SELinux), (3) a labeling operation that fails during mknod execution (due to policy unavailability, permission denial, or transient system error), and (4) the attacker or malicious process capable of accessing the resulting mislabeled device node. The vulnerability does NOT require user interaction, special network configuration, or non-default filesystem setup. Exploitation is prevented on: (1) non-SELinux systems, (2) systems where mknod is not available or restricted by capability dropping, (3) successful SELinux labeling (normal operation), and (4) systems where the resulting device node is restricted by filesystem permissions independent of SELinux labels.

CVSS 3.4 (low) with vector AV:L/AC:L/PR:H indicates local-only attack surface requiring root or elevated privileges, no user interaction, and low complexity - appropriate for a privilege management flaw in a sysadmin utility. SSVC framework alignment: Exploitation=none (no active exploitation), Automatable=no (requires local access and specific failure conditions), Technical Impact=partial (partial integrity and confidentiality impact from mislabeled nodes). The authentication bypass tag is justified: once a mislabeled device node exists, unprivileged users or processes with weaker SELinux domains may gain unauthorized access that would have been denied by the intended label. However, real-world risk is constrained by three factors: (1) requires active exploitation of mknod with intentional or incidental labeling failure, (2) impact is localized to that specific device node, not systemic, and (3) systems without SELinux enabled are unaffected. This is a real but limited-scope vulnerability - not a critical infrastructure threat, but a defense-in-depth concern for hardened systems relying on SELinux for device access control.

A local attacker with root privileges (or via privilege escalation) executes mknod to create a device node for a security-critical device (e.g., /dev/mem, /dev/kmem). The attacker deliberately triggers a labeling failure (e.g., by corrupting SELinux policy files or exhausting label storage) so cleanup fails. The device node remains with permissive default context. An unprivileged process or user session can then access the device, bypassing intended SELinux restrictions and potentially escalating privileges or exfiltrating kernel memory. Alternatively, a configuration management system or init script fails silently during device node creation, unintentionally leaving mislabeled nodes in production.