uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

检查时间与使用时间(TOCTOU)的竞争条件

uutils coreutils 后置链接漏洞

uutils coreutils是Uutils开源的一个跨平台核心命令行工具集。 uutils coreutils存在后置链接漏洞，该漏洞源于tail实用程序在使用--follow=name选项时可能泄露敏感文件内容，与GNU tail不同，uutils实现在路径被符号链接替换后继续监视该路径，随后输出链接目标的内容，在特权用户监视日志目录的环境中，具有该目录写入权限的本地攻击者可将日志文件替换为指向敏感系统文件的符号链接，导致tail泄露敏感文件内容。

N/A

N/A