CVE-2026-35358

MEDIUM4.4EPSS 0.01%

uutils coreutils Uses Incorrectly-Resolved Name or Reference

發布日:2026/4/22修改日:2026/5/5
也稱為:GHSA-67hp-f6hq-2h6g

描述

The cp utility in uutils coreutils, when performing recursive copies (-R), incorrectly treats character and block device nodes as stream sources rather than preserving them. Because the implementation reads bytes into regular files at the destination instead of using mknod, device semantics are destroyed (e.g., /dev/null becomes a regular file). This behavior can lead to runtime denial of service through disk exhaustion or process hangs when reading from unbounded device nodes.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

參考連結(7)