Executive brief
The 'mv' utility in uutils coreutils (a Rust-based alternative to standard Linux command-line tools) fails to properly handle symbolic links when moving files between different disks or partitions. Instead of moving the link itself, the tool copies the actual data the link points to, which can lead to unexpected disk space exhaustion or the accidental duplication of sensitive data into insecure locations. In some cases, this behavior can cause the system to enter an infinite loop if links point back to themselves.
Technical details
A vulnerability exists in the 'mv' utility of uutils coreutils due to improper link resolution (CWE-59) during cross-filesystem moves. When a directory tree containing symbolic links is moved across filesystem boundaries, the implementation expands the symlinks and copies the target files/directories to the destination instead of preserving the link. A local attacker can exploit this by creating symlinks to large files or sensitive directories, potentially causing resource exhaustion (disk space/time), unauthorized data duplication, or infinite recursion in the case of symlink loops. The issue is fixed in version 0.7.0 by ensuring symlinks are preserved during cross-device operations.
Affected products
- uutils coreutils (Rust) < 0.7.0
Timeline
- 2026-01-28: other: Pull request submitted to fix the issue
- 2026-03-05: patched: Fix merged into main branch
- 2026-03-08: other: Version 0.7.0 released
- 2026-04-22: disclosed: Initial advisory publication
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-h444-6j9x-p8vh