The vulnerability exists in the uutils coreutils tail command's handling of the --follow=name option. Unlike GNU tail, uutils tail does not stop monitoring a file path when it is replaced by a symbolic link. This allows a local attacker with write access to a directory monitored by a privileged user to replace a log file with a symlink to a sensitive file. The tail utility then outputs the contents of the sensitive file, leading to unauthorized information disclosure. The issue is classified as a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367).

The vulnerability can lead to unauthorized disclosure of sensitive file contents, such as /etc/shadow, if a privileged user uses uutils tail with --follow=name on a directory writable by a local attacker. This compromises confidentiality but does not affect integrity or availability. Exploitation requires local write access and privileges to monitor logs, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the --follow=name option of uutils tail on directories writable by untrusted users, especially when running with elevated privileges. Consider using GNU tail as an alternative, which does not exhibit this behavior.