Executive brief
A vulnerability in the 'rm' utility of the Rust-based uutils coreutils allows users to bypass the safety mechanism intended to prevent accidental deletion of the system's root directory. By using a symbolic link that points to the root directory, the tool fails to recognize it is operating on the system core, potentially leading to the unintended deletion of the entire filesystem. This could result in a complete system failure or loss of all hosted data if executed with sufficient permissions.
Technical details
The 'rm' utility in uutils coreutils (uu_rm) implements the '--preserve-root' protection using a path-string check (path.has_root() && path.parent().is_none()) instead of comparing device and inode numbers. Because a symbolic link pointing to '/' (e.g., /tmp/rootlink -> /) contains a parent component in its path string, it bypasses the string-based check. An attacker or user can trigger a recursive deletion of the root filesystem by targeting such a symlink. The vulnerability was fixed in version 0.7.0 by implementing a check that compares the device/inode of traversed directories against the cached metadata of the root directory.
Affected products
- uutils coreutils (uu_rm) < 0.7.0
Timeline
- 2025-12-18: other: Initial pull request submitted
- 2026-01-20: disclosed: Reported by Zellic in security assessment
- 2026-02-05: patched: Fix merged into main branch
- 2026-05-30: advisory: GitHub Advisory published
- 2026-07-06: other: Advisory updated and reviewed
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-7cr3-h577-g38j
- https://github.com/uutils/coreutils/pull/9706
- https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e
- https://github.com/uutils/coreutils/releases/tag/0.7.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-7cr3-h577-g38j