The vulnerability in the comm utility of uutils coreutils arises because the are_files_identical function reads from both input paths to compare contents without verifying that the inputs are regular files. When inputs are non-regular files (e.g., FIFOs, pipes), this pre-read operation consumes data prematurely, leading to silent data loss. Additionally, if the input is an infinite stream such as /dev/zero, the utility may hang indefinitely. This issue affects versions of uutils coreutils prior to 0.6.0. The advisory is a duplicate and has been withdrawn, but it preserves references to the original report.

This vulnerability can cause silent loss of data when the comm utility is used with non-regular file inputs because the utility consumes data from these streams before performing comparison operations. It may also cause the utility to hang indefinitely when processing infinite streams, potentially leading to denial of service conditions. There is no impact on confidentiality, but integrity and availability are affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided and the advisory is withdrawn as a duplicate, users should refer to the original advisory GHSA-3wfc-mgpm-9rq6 for remediation information. Until a fix is applied, avoid using the comm utility on non-regular files such as FIFOs, pipes, or infinite streams to prevent data loss or hangs.