uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

检查时间与使用时间(TOCTOU)的竞争条件

uutils coreutils 安全漏洞

uutils coreutils是Uutils开源的一个跨平台核心命令行工具集。 uutils coreutils存在安全漏洞，该漏洞源于mv实用程序在跨设备移动期间存在检查时间到使用时间漏洞，扩展属性保留逻辑使用多个基于路径的系统调用，每个操作都执行新的路径到inode查找，具有目录写入权限的本地攻击者可利用此竞争在调用之间交换文件，导致目标文件接收不一致的安全扩展属性混合。

N/A

N/A