Executive brief
uutils coreutils is a Rust-based implementation of standard Unix command-line utilities. A vulnerability was identified where security protections designed to prevent file system race conditions were only active on Linux, leaving users on macOS and FreeBSD vulnerable. An attacker with local access could potentially exploit this to manipulate files or directories during system operations, leading to unauthorized data access or modification.
Technical details
The safe_traversal module in uutils coreutils (Rust implementation) was designed to mitigate Time-of-Check to Time-of-Use (TOCTOU) symlink race conditions by using file-descriptor-relative system calls. However, this protection was incorrectly gated behind a Linux-specific configuration flag. On other Unix-like systems such as macOS and FreeBSD, the utility defaulted to unsafe traversal methods. A local attacker could exploit this race condition during directory traversal operations (e.g., in 'rm' or 'chmod') to redirect file operations to unintended targets via symlinks. This issue is resolved in version 0.6.0 by expanding the module's support to all Unix platforms.
Affected products
- uutils coreutils < 0.6.0
Timeline
- 2025-12-23: other: Pull request submitted to fix the issue
- 2026-01-09: other: Fix merged into main branch
- 2026-02-02: patched: Version 0.6.0 released
- 2026-04-22: advisory: Initial advisory published
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-w6xc-g9qj-vp32