Executive brief
A vulnerability in the 'kill' utility of the uutils coreutils package could allow a local user to inadvertently crash the system or terminate all of their running processes. Due to a command-line parsing error, the utility may misinterpret certain inputs as a command to signal every process visible to the user. This can lead to immediate service outages or a complete system shutdown depending on the user's permissions.
Technical details
An argument parsing error in the 'kill' utility of uutils coreutils (the Rust implementation of GNU coreutils) incorrectly handles the input 'kill -1'. Instead of recognizing '-1' as a signal number and erroring out due to a missing PID, the utility interprets it as a request to send the default SIGTERM signal to PID -1. In Unix-like systems, sending a signal to PID -1 instructs the kernel to signal every process the caller has permission to signal, which can result in a Denial of Service (DoS) by terminating all active processes or crashing the system. This issue is rooted in improper input validation (CWE-20) and was fixed in version 0.6.0 by ensuring the parser correctly distinguishes between signal numbers and process identifiers.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2025-12-19: patched: Fix merged into main branch via pull request #9700
- 2026-02-02: advisory: Version 0.6.0 released with the fix
- 2026-04-22: disclosed: Initial GHSA and CVE publication
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-p6rv-2qpm-fwvg