GHSA-x2wv-9p67-mh9wMediumCVSS 6.6
uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails
🔗 CVE IDs covered (1)
📋 Description
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.
🎯 Affected products1
- rust/coreutils:<= 0.8.0