Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| coreutils | rust | < 0.6.0 | 0.6.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in the uutils/coreutils project. The safe_traversal module, which provides TOCTOU protection using file-descriptor-relative syscalls, was conditionally compiled only for Linux systems. This left other Unix-like operating systems, such as macOS and FreeBSD, vulnerable to symlink race conditions during file system operations that involve directory traversal.
The analysis of the patch commit 30239e69a328e76d2377f2a0bc02fbde61c34280 reveals that the fix involves changing the conditional compilation flag from #[cfg(target_os = "linux")] to #[cfg(all(unix, not(target_os = "redox")))]. This change enables the safe_traversal feature for all Unix-like systems except for Redox.
The vulnerable functions are those that perform file system traversal and manipulation, and which, prior to the patch, did not use the safe_traversal module on non-Linux Unix systems. These include functions in chmod, du, and rm utilities. For example, in rm, the remove_dir_recursive function had a separate, unsafe implementation for non-Linux platforms. By identifying where the safe_traversal feature was not being used on Unix platforms, I was able to pinpoint the exact functions that would be vulnerable during exploitation.
