Executive brief
A vulnerability in the uutils implementation of the mkfifo command can cause existing files to have their security permissions unintentionally weakened. If a user attempts to create a new pipe (FIFO) at a location where a file already exists, the tool fails to stop and instead resets the existing file's permissions to a default public-readable state. This could allow a local attacker to gain access to sensitive private data, such as SSH keys, that were previously restricted.
Technical details
A logic error in the mkfifo implementation of uutils coreutils leads to an improper preservation of permissions (CWE-281). When mkfifo() fails because the target path already exists, the program fails to execute a 'continue' statement and instead falls through to a 'set_permissions' call. This causes the pre-existing file's permissions to be modified to the default FIFO mode (typically 0644 after umask). A local attacker can exploit this to relax permissions on sensitive files owned by other users. The issue is fixed in version 0.6.0.
Affected products
- uutils coreutils (uutils) < 0.6.0
Timeline
- 2026-01-03: disclosed: Initial issue reported on GitHub
- 2026-01-21: patched: Fix merged in PR #10376
- 2026-04-22: advisory: CVE-2026-35341 assigned and published by NVD
- 2026-07-06: advisory: GitHub Advisory published