Executive brief
A flaw in the Rust-based uutils coreutils implementation of the chown and chgrp commands causes them to report success even if some file ownership changes failed. When processing directories recursively, the tools only check the result of the very last file processed; if that file succeeds, the command returns a success code regardless of earlier failures. This can lead to security misconfigurations where administrative scripts incorrectly assume that sensitive files have had their ownership or group permissions properly updated.
Technical details
A vulnerability exists in the ChownExecutor component of uutils coreutils (the Rust implementation of GNU coreutils) affecting the chown and chgrp utilities. During recursive operations, the final exit code is determined solely by the result of the last file processed in the directory tree. If earlier files fail to update due to permission errors but the final file succeeds, the utility returns an exit code of 0. This 'Incorrect Check of Function Return Value' (CWE-253) allows local users or automated scripts to be misled about the integrity of ownership changes. The issue is fixed in version 0.6.0 by ensuring the exit code reflects any encountered errors during the traversal.
Affected products
- uutils coreutils < 0.6.0
Timeline
- 2026-01-09: patched: Fix merged into main branch
- 2026-02-02: advisory: Version 0.6.0 released
- 2026-04-22: disclosed: Initial GHSA and CVE publication
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-2x2h-fw32-rq7v