3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vf87-345h-9qhx

GHSA-vf87-345h-9qhx: Duplicate Advisory: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mj6p-44ch-cq69. This link is maintained to preserve external references.

Original Description

The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vf87-345h-9qhx

GHSA-vf87-345h-9qhx:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
coreutils	rust	< 0.6.0	0.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in the mkdir utility of uutils/coreutils. The patch addresses this by changing how directories are created when a specific mode is requested with the -m flag.

The analysis of the commit 037b9583bc03d814e8516df54ebcda6f681fe1f8 reveals the core of the issue. The vulnerable logic was located in the create_single_dir function in src/uu/mkdir/src/mkdir.rs. Previously, this function would call std::fs::create_dir() to create the directory, which would use the system's umask for initial permissions, and then it would call a chmod function to apply the mode specified by the user. This creates a small time window where the directory exists with incorrect, potentially less restrictive, permissions.

The fix involves introducing a new function, create_dir_with_mode, which wraps the directory creation in a UmaskGuard. This guard temporarily sets the umask to 0, ensuring that the directory is created atomically with the exact permissions specified by the user, thus eliminating the race condition. The create_single_dir function was then updated to use this new atomic creation method.

Based on this, the function create_single_dir is identified as the vulnerable function because it contained the flawed logic of creating and then changing permissions, which is the root cause of the TOCTOU vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.