Executive brief
The mknod utility in uutils coreutils, a Rust-based alternative to the standard GNU core utilities, contains a flaw in how it handles security labels on SELinux-enabled systems. When creating special system files (device nodes), the tool may fail to apply the correct security context and then fail to remove the incorrectly labeled file. This can result in orphaned device nodes that bypass intended security restrictions, potentially allowing unauthorized access to hardware or system resources.
Technical details
The mknod utility in uutils coreutils (specifically the uu_mknod crate) creates device nodes before setting the SELinux security context, rather than using atomic labeling via setfscreatecon. If the subsequent call to set_selinux_security_context fails, the utility attempts to clean up the node using std::fs::remove_dir. Because remove_dir cannot delete device nodes or FIFOs, the cleanup fails silently, leaving a mislabeled node on the filesystem. This node inherits a default context that may be less restrictive than intended, potentially bypassing Mandatory Access Control (MAC) policies. The vulnerability is addressed in version 0.6.0 by switching to std::fs::remove_file for cleanup and recommending atomic labeling.
Affected products
- uutils coreutils (uu_mknod) < 0.6.0
Timeline
- 2026-01-20: disclosed: Reported by Zellic in security assessment
- 2026-01-31: patched: Fix merged into main branch
- 2026-05-30: advisory: Initial advisory published
- 2026-07-06: advisory: GitHub Advisory reviewed and updated
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-r9hw-mj3w-phcq
- https://github.com/uutils/coreutils/pull/10582
- https://github.com/uutils/coreutils/commit/42b2ad83cdcf6e959ecb378c5040c60d9c64becf
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-r9hw-mj3w-phcq