Executive brief
A vulnerability in the 'install' utility of the Rust-based uutils coreutils allows a local attacker to overwrite arbitrary files on the system. By exploiting a timing window during directory creation, an attacker can redirect file writes to unintended locations, such as sensitive system files. This could lead to a complete system compromise if the utility is run with elevated (root) privileges.
Technical details
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the `install` utility of `uutils/coreutils` when using the `-D` flag. The implementation uses `fs::create_dir_all` followed by path-based `File::create` or `fs::copy` operations, neither of which are anchored to a directory file descriptor. A local attacker with concurrent write access to the destination tree can replace a path component with a symbolic link between the directory creation and the file write. This redirects the privileged write to an arbitrary location on the filesystem. The fix involves migrating to `dirfd`-based operations (`openat`, `mkdirat`) with `O_NOFOLLOW` to ensure path resolution is securely anchored.
Affected products
- uutils coreutils (uu_install) < 0.7.0
Timeline
- 2026-01-09: other: Fix submitted via Pull Request 10140
- 2026-01-20: disclosed: Reported by Zellic in security assessment
- 2026-02-14: patched: Fix merged into main branch
- 2026-05-30: advisory: Initial GitHub Advisory published
- 2026-07-06: advisory: Advisory updated and reviewed
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-gwm6-q8ch-hcfr
- https://github.com/uutils/coreutils/pull/10140
- https://github.com/uutils/coreutils/commit/0c41299975f3c1e21cf5ca968d42cad55ceb42a1
- https://github.com/uutils/coreutils/releases/tag/0.7.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-gwm6-q8ch-hcfr