Executive brief
The 'cp' utility in uutils coreutils, a Rust-based implementation of standard system tools, fails to correctly handle special device files during recursive copy operations. Instead of recreating these system nodes, it attempts to read them as data streams, which can cause the system to hang or fill up disk space. This can disrupt system operations, especially when creating container environments or system backups.
Technical details
A vulnerability exists in the 'cp' utility of uutils coreutils when performing recursive copies (-R). The implementation incorrectly identifies character and block device nodes as streams (via is_stream()) and attempts to read their contents into regular files at the destination instead of using mknod to preserve device semantics. A local attacker or a misconfigured process could trigger this by copying a directory containing unbounded device nodes (like /dev/zero or /dev/null), leading to disk exhaustion or an infinite process hang. The issue is fixed in version 0.7.0 by ensuring special files are handled correctly rather than being read as streams.
Affected products
- uutils coreutils < 0.7.0
Timeline
- 2025-12-20: disclosed: Issue reported on GitHub
- 2026-03-04: patched: Fix merged into main branch
- 2026-03-08: advisory: Release 0.7.0 published
- 2026-04-22: advisory: Initial GHSA and NVD publication