Executive brief
The mkdir utility in the Rust-based uutils coreutils contains a flaw in how it handles directory permissions when using the -m flag. Instead of creating a directory with the requested private permissions immediately, it briefly creates it with default system permissions before adjusting them. In shared computing environments, this creates a split-second window where an unauthorized user could access sensitive data within that directory before it is properly secured.
Technical details
A Time-of-check Time-of-use (TOCTOU) race condition exists in the mkdir utility of uutils coreutils prior to version 0.6.0. When the -m (mode) flag is used, the utility performs two separate operations: first, it creates the directory using the current umask (typically resulting in 0755 permissions), and then it issues a separate chmod system call to apply the requested mode. An attacker on the same multi-user system can exploit this race window to access the directory before the chmod command executes. The fix, introduced in version 0.6.0, ensures atomicity by temporarily setting the process umask to 0 and passing the requested mode directly to a single mkdir system call.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2026-01-18: patched: Fix merged into main branch via PR #10036
- 2026-02-02: advisory: Release 0.6.0 published
- 2026-04-22: disclosed: Initial advisory publication
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-mj6p-44ch-cq69