Описание
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.
Ссылки
- Issue TrackingPatch
- Release Notes
Уязвимые конфигурации
EPSS
3.6 Low
CVSS3
Дефекты
Связанные уязвимости
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.
The safe_traversal module in uutils coreutils, which provides protecti ...
uucore: safe_traversal TOCTOU protection only enabled on Linux
EPSS
3.6 Low
CVSS3