The vulnerability in uutils coreutils mkfifo arises when the command attempts to create a FIFO at a path where a file already exists. Instead of terminating the operation, mkfifo continues and executes a permissions change on the existing file, resetting its permissions to a default mode (commonly 644 after umask). This unintended permission modification can expose sensitive files such as SSH private keys to other users on the system. The issue is tracked under CWE-732 (Incorrect Permission Assignment for Critical Resource) and affects versions <=0.8.0 of uutils coreutils.

Unauthorized users with local access may gain read access to sensitive files whose permissions have been improperly reset by the vulnerable mkfifo operation. This can lead to confidentiality breaches, such as exposure of private keys or other sensitive data. The vulnerability does not affect availability and requires local privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running mkfifo on paths where files may already exist or manually verify and correct file permissions after mkfifo operations. Monitor vendor channels for an official fix.