Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

uutils/coreutils

              main @ be93dc3
            

Fixes

CVEs

CRITICAL

Peak severity

8.8%

Coverage

Highlights

Path Traversal: 18 prior fixes. Scrutinize any change in this area.

src/uu/install/src/install.rs: most-fixed (5 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Recursive directory walks in utilities like chown, chgrp, chmod, and rm are highly susceptible to TOCTOU symlink-swapping. Attackers can swap a directory for a symlink during traversal, leading to unauthorized actions on targeted files. Use of O_NOFOLLOW on subdir opens via 'open_subdir' was required to secure these paths.

TOCTOU: A time gap between creating a FIFO or special file and calling chmod to apply permissions allows attackers to win a race, substituting the path with a symlink to hijack the chmod operation. This is mitigated by atomically setting permissions during creation with umask and 'mkfifoat'.

Privilege Escalation: During 'cp -p', if ownership preservation (chown) fails, copying the setuid/setgid bits without successful owner change allows local users to create arbitrary privileged executables. The fix forces stripping of these bits when chown fails.