GHSA-x2wv-9p67-mh9wMediumCVSS 6.6

uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

Published
April 22, 2026
Last Modified
April 29, 2026

🔗 CVE IDs covered (1)

📋 Description

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

🎯 Affected products1

  • rust/coreutils:<= 0.8.0

🔗 References (3)