CVE-2026-35361

LOW3.4EPSS 0.02%

uutils coreutils has an Improper Preservation of Permissions issue

發布日:2026/4/22修改日:2026/5/5
也稱為:GHSA-79rc-qpw3-jv92

描述

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1LOW3.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

參考連結(6)