Duplicate Advisory: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mj6p-44ch-cq69. This link is maintained to preserve external references. ### Original Description The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.
AI Analysis
Technical Summary
The mkdir utility in uutils coreutils versions before 0.6.0 improperly applies permissions when invoked with the -m flag. It initially creates the directory with permissions derived from the system umask (commonly 0755) and then changes the permissions to the requested mode using a separate chmod call. This sequence introduces a TOCTOU race condition, allowing a short time window where the directory is more permissive than intended, potentially exposing private directories to unauthorized users in multi-user environments. This advisory is a duplicate and has been withdrawn, with GHSA-mj6p-44ch-cq69 as the primary reference.
Potential Impact
The vulnerability allows a brief window during directory creation where permissions are more permissive than intended, potentially enabling unauthorized users to access directories that should be private. The impact is limited to confidentiality (low impact), with no integrity or availability effects reported. No known exploits are in the wild.
Mitigation Recommendations
No patch links are provided in this advisory, and the advisory is marked as a duplicate and withdrawn. Users should refer to the primary advisory GHSA-mj6p-44ch-cq69 for remediation status and guidance. Patch status is not yet confirmed in this advisory — check the vendor advisory for current remediation guidance.
Duplicate Advisory: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition
Description
### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mj6p-44ch-cq69. This link is maintained to preserve external references. ### Original Description The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.
CVSS v3.1
Score 3.3low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The mkdir utility in uutils coreutils versions before 0.6.0 improperly applies permissions when invoked with the -m flag. It initially creates the directory with permissions derived from the system umask (commonly 0755) and then changes the permissions to the requested mode using a separate chmod call. This sequence introduces a TOCTOU race condition, allowing a short time window where the directory is more permissive than intended, potentially exposing private directories to unauthorized users in multi-user environments. This advisory is a duplicate and has been withdrawn, with GHSA-mj6p-44ch-cq69 as the primary reference.
Potential Impact
The vulnerability allows a brief window during directory creation where permissions are more permissive than intended, potentially enabling unauthorized users to access directories that should be private. The impact is limited to confidentiality (low impact), with no integrity or availability effects reported. No known exploits are in the wild.
Mitigation Recommendations
No patch links are provided in this advisory, and the advisory is marked as a duplicate and withdrawn. Users should refer to the primary advisory GHSA-mj6p-44ch-cq69 for remediation status and guidance. Patch status is not yet confirmed in this advisory — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-vf87-345h-9qhx
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["crates.io"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a4c340d27e9c797195f7154
Added to database: 07/06/2026, 23:02:37 UTC
Last enriched: 07/06/2026, 23:16:46 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.