The dd utility in uutils coreutils has an unchecked return value vulnerability (CWE-252) where it suppresses errors during file truncation by always calling Result::ok(). While this mimics GNU coreutils behavior for special files such as /dev/null, it also hides truncation failures on regular files and directories caused by environmental issues like full disks or read-only file systems. As a result, the utility may report successful completion despite the destination file not being correctly truncated, potentially leading to silent data corruption in automated scripts relying on dd for backups or migrations.

This vulnerability can lead to silent data corruption because the dd utility may report successful truncation even when it fails due to disk full or read-only filesystem conditions. This affects data integrity in backup or migration operations that depend on dd, as corrupted or stale data may be written without any error indication. There is no impact on confidentiality or availability reported. The CVSS score is 3.3 (low severity), reflecting limited impact primarily on data integrity without privilege escalation or remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be aware of this behavior and consider additional verification steps after using dd to ensure truncation succeeded, especially in critical backup or migration workflows. Monitoring return values explicitly or using alternative tools that properly report truncation errors may mitigate risk.