Executive brief
The 'comm' utility in the Rust implementation of coreutils contains a flaw in how it handles non-standard file inputs like pipes or system devices. When comparing data, the tool may accidentally consume and discard information from these streams before the actual comparison begins, leading to silent data loss. Additionally, the tool may stop responding if it attempts to read from infinite data sources like /dev/zero.
Technical details
The 'comm' utility in uutils coreutils (Rust) contains an improper input validation vulnerability (CWE-20) within the 'are_files_identical' function. The function opens and reads from both input paths to determine if they are the same file without first verifying if the paths refer to regular files. When an input path is a FIFO or a pipe, this pre-read operation drains the stream, causing data to be lost before the actual comparison logic executes. Furthermore, the utility may hang indefinitely when attempting to pre-read from infinite streams such as /dev/zero. The issue is fixed in version 0.6.0 by skipping the identity check if one of the files is not a regular file.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2025-12-02: other: Pull request submitted to fix the issue
- 2026-01-17: patched: Fix merged into main branch
- 2026-02-02: advisory: Release 0.6.0 published
- 2026-04-22: disclosed: CVE-2026-35347 published
- 2026-07-06: other: GHSA-rx8h-33gr-vhj9 withdrawn as duplicate of GHSA-3wfc-mgpm-9rq6