Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the chmod utility of uutils/coreutils, where the --preserve-root safety mechanism could be bypassed. The root cause was an insufficient validation of the file path. The code only checked if the path was literally /, failing to account for other representations of the root directory, such as /../ or symlinks. This allowed for a path traversal vulnerability. The patch addresses this by introducing a new function, is_root, which canonicalizes the file path using fs::canonicalize before comparing it to the root directory. This ensures that any path that resolves to / is correctly identified and handled. The vulnerable code was located in the walk_dir method of the Chmoder struct, which is responsible for recursively applying permissions. An attacker could exploit this by providing a crafted path to the chmod command with the -R (recursive) flag, leading to unauthorized and destructive permission changes on the entire filesystem.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| coreutils | rust | < 0.6.0 | 0.6.0 |
