The vulnerability in uutils coreutils mkfifo arises from improper handling of existing files at the target path. When mkfifo attempts to create a FIFO but finds a file already present, it does not terminate the operation for that path. Instead, it proceeds to execute a set_permissions call that resets the existing file's permissions to a default mode, typically 644 after applying the system's umask. This incorrect permission assignment (CWE-732) can expose sensitive files to unauthorized users by reducing their protection. The issue affects local users with the ability to run mkfifo and requires low privileges but no user interaction. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts.

The vulnerability allows unauthorized modification of permissions on existing files when mkfifo fails to create a FIFO due to a pre-existing file. This can lead to sensitive files, such as SSH private keys, being exposed to other users on the system by changing their permissions to a less restrictive default mode. The impact is high confidentiality and integrity loss but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid running mkfifo on paths where files may already exist or manually verify and correct file permissions after using mkfifo. Monitoring and restricting local user access to sensitive files can help reduce risk.