Executive brief
A security feature in the uutils coreutils library, designed to prevent attackers from manipulating files during system operations, was accidentally disabled on non-Linux systems like macOS and FreeBSD. This could allow a local attacker to trick system utilities into modifying or accessing files they shouldn't by using symbolic link races. While the risk is low and requires precise timing, it undermines the security of file operations on affected platforms.
Technical details
The safe_traversal module in uucore (uutils coreutils) implements protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races by using file-descriptor-relative syscalls (e.g., openat). However, these protections were gated behind a #[cfg(target_os = "linux")] attribute. On other Unix-like systems such as macOS and FreeBSD, the library reverted to unsafe traversal methods. A local attacker could exploit this race condition during directory traversal operations (used by utilities like 'rm', 'chmod', and 'du') to redirect file operations to unintended targets via symlinks. The issue is fixed in version 0.6.0 by expanding the feature guards to all Unix platforms.
Affected products
- uutils uucore < 0.6.0
- uutils coreutils < 0.6.0
Timeline
- 2025-12-23: other: Pull request submitted to expand safe traversal support
- 2026-01-09: patched: Fix merged into main branch
- 2026-05-30: advisory: Initial advisory published
- 2026-07-06: disclosed: GitHub Advisory published
References
- https://github.com/uutils/coreutils/security/advisories/GHSA-w6xc-g9qj-vp32
- https://github.com/uutils/coreutils/pull/9792
- https://github.com/uutils/coreutils/commit/30239e69a328e76d2377f2a0bc02fbde61c34280
- https://github.com/uutils/coreutils/releases/tag/0.6.0
- https://api.github.com/repos/uutils/coreutils/security-advisories/GHSA-w6xc-g9qj-vp32