Executive brief
The 'id' utility in uutils coreutils, a Rust-based implementation of standard system tools, contains a bug that displays incorrect user information. When a user's effective identity differs from their real identity, the tool may show the wrong username in its output. This can mislead system administrators or automated scripts into making incorrect security decisions regarding file permissions and access controls.
Technical details
A logic error exists in the 'id' utility of uutils coreutils (specifically the uu_id crate) where the implementation incorrectly uses the effective Group ID (GID) instead of the effective User ID (UID) when performing a name lookup for the effective user. This occurs specifically in the 'pretty print' output mode when the real UID and effective UID differ. An attacker with local access cannot directly escalate privileges through this bug, but the resulting UI misrepresentation (CWE-451) can cause diagnostic tools or scripts to misidentify the active user context. The issue was identified in audited commit 3a07ffc5 and is fixed in version 0.6.0.
Affected products
- uutils coreutils (uu_id) < 0.6.0
Timeline
- 2026-01-03: disclosed: Issue reported on GitHub
- 2026-05-30: advisory: GitHub Advisory published
- 2026-05-30: patched: Version 0.6.0 released