https://seclists.org/oss-sec/2026/q2/373: uutils coutils CVEs
Published May 4, 2026
·Updated
Affected Software
1 affected component
uutils uutils coreutils mkfifo=0.8.0
Frequently Asked Questions
1
Who is exposed to the permission-window issue?
Users who run uutils coreutils mkfifo in a location where another local user can access the newly created FIFO during creation are exposed. The example uses /tmp/fifo, where the FIFO is initially created world-readable and world-writable before its mode is changed.
2
What does an attacker need to exploit the issue?
The attacker needs local access and an opportunity to act between FIFO creation and the subsequent chmod call. For the issue described as involving a symlink swap, the attacker also needs write access to the FIFO's parent directory.
3
Are default permissions affected?
Yes. The provided trace shows mkfifo temporarily creating the FIFO with mode 0666, subject to the process umask, before applying the requested 0700 mode with chmod.