Executive brief
A vulnerability exists in the 'install' utility of the Rust-based uutils coreutils package. When creating directories, the tool is susceptible to a race condition where a local attacker can swap a directory for a symbolic link at the exact moment the tool is working. This could allow an attacker to trick the system into writing or modifying files in unintended, sensitive locations, potentially leading to unauthorized system changes.
Technical details
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the 'install' utility of uutils coreutils when using the -D flag. The root cause is that the utility creates parent directories and subsequently performs a second path resolution to create the target file without anchoring these operations to a directory file descriptor. A local attacker with concurrent write access can exploit this race window to replace a path component with a symbolic link, redirecting a privileged write to an arbitrary filesystem location. The issue is resolved in version 0.7.0 by implementing directory file descriptor-anchored operations (mkdirat/openat) to ensure path resolution remains consistent.
Affected products
- uutils coreutils (Rust) < 0.7.0
Timeline
- 2026-01-09: other: Fix proposed in pull request 10140
- 2026-02-14: patched: Fix merged into main branch
- 2026-03-08: advisory: Release 0.7.0 published with the fix
- 2026-04-22: disclosed: Initial advisory publication
- 2026-07-06: other: Advisory withdrawn as duplicate of GHSA-gwm6-q8ch-hcfr