uutils coreutils mkfifo Unauthorized Permission Change on Existing Files

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and continues to execute a follow-up set_permissions call. This results in the existing file's permissions being changed to the default mode (often 644 after umask), potentially exposing sensitive files such as SSH private keys to other users on the system.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

关键资源的不正确权限授予

uutils coreutils 安全漏洞

uutils coreutils是Uutils开源的一个跨平台核心命令行工具集。 uutils coreutils存在安全漏洞，该漏洞源于mkfifo允许未经授权修改现有文件的权限，当mkfifo因目标路径已存在文件而无法创建FIFO时，未能终止该路径的操作并继续执行后续set_permissions调用，导致现有文件的权限更改为默认模式，可能将敏感文件暴露给系统上的其他用户。

N/A

N/A