Executive brief
The 'comm' utility, a tool used to compare two files line-by-line, contains a flaw that causes it to incorrectly handle data from pipes and special system files. When a user attempts to compare data coming from a stream rather than a standard file, the tool may accidentally discard data or stop responding entirely. This can lead to silent data loss or system processes hanging during automated data processing tasks.
Technical details
A vulnerability in the 'comm' utility of uutils coreutils arises from the 'are_files_identical' function, which attempts to compare file contents by reading from input paths without verifying if they are regular files. When the input is a FIFO or a pipe, this pre-read operation 'drains' the stream, causing the subsequent comparison logic to miss data. Additionally, attempting to read from infinite streams like /dev/zero can cause the utility to hang indefinitely. The issue is triggered locally when a user or script passes non-regular files as arguments to the utility. This was resolved in version 0.6.0 by skipping the identity check for non-regular files.
Affected products
- uutils coreutils (uu_comm) < 0.6.0
Timeline
- 2025-12-02: other: Initial pull request submitted to fix the issue
- 2026-01-17: patched: Fix merged into main branch
- 2026-02-02: other: Version 0.6.0 released
- 2026-05-30: disclosed: Vulnerability disclosed by Zellic
- 2026-07-06: advisory: GitHub Advisory published
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-3wfc-mgpm-9rq6
- https://github.com/uutils/coreutils/pull/9545
- https://github.com/uutils/coreutils/commit/75f45e87e52ed95840494963ab9a28651165d56e
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-3wfc-mgpm-9rq6