Executive brief
The 'cp' utility in uutils coreutils, a Rust-based alternative to standard system tools, contains a flaw when copying directories. Instead of preserving special system files (device nodes), it attempts to read them as data streams, which can cause the system to hang or fill up all available disk space. This can disrupt system operations and prevent the creation of correct system backups or environment clones.
Technical details
The uutils coreutils 'cp' utility, when using the recursive (-R) flag, fails to correctly handle character and block device nodes. Instead of using mknod to recreate the device node at the destination, the implementation treats these nodes as streams and attempts to read their contents into regular files. This occurs because the is_stream() function incorrectly returns true for these device types. An attacker or local user can trigger this behavior to cause a denial of service via disk exhaustion (if reading from an unbounded device like /dev/zero) or by causing the process to hang indefinitely (if reading from a blocking device). This also breaks the integrity of copied filesystem trees, such as chroot environments or container images. The issue is fixed in version 0.7.0.
Affected products
- uutils coreutils (uu_cp) < 0.7.0
Timeline
- 2025-12-20: disclosed: Issue first opened on GitHub
- 2026-01: other: Reported in Zellic Program Security Assessment
- 2026-03-04: patched: Fix merged into main branch
- 2026-05-30: advisory: GitHub Advisory published
- 2026-07-06: advisory: Advisory updated and reviewed
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-8vrf-r662-2w2v
- https://github.com/uutils/coreutils/issues/9746
- https://github.com/uutils/coreutils/pull/11163
- https://github.com/uutils/coreutils/commit/e6a3bb596f149628ba973eec3d099f3bb69f2464
- https://github.com/uutils/coreutils/releases/tag/0.7.0