The cp utility in uutils coreutils fails to properly clear setuid and setgid bits when the ownership preservation operation (chown) fails during a copy with the -p flag. This results in user-owned copies retaining privileged mode bits, which can lead to unexpected privileged executables. The issue is categorized under CWE-281 (Improper Preservation of Permissions). The vulnerability has a CVSS 3.1 base score of 6.6 (medium severity) with local attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, low confidentiality impact, high integrity impact, and low availability impact. No patch or official remediation level is indicated in the vendor or CVE data.

If exploited, this vulnerability can cause user-owned files to retain setuid or setgid bits improperly, potentially allowing privilege escalation or violation of local security policies. The integrity of the system could be compromised due to unauthorized privileged executables. Confidentiality impact is low and availability impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the -p flag with uutils coreutils cp in environments where setuid/setgid bits are critical or consider using alternative utilities such as GNU cp that handle this scenario correctly.