GHSA-79rc-qpw3-jv92

Source

https://github.com/advisories/GHSA-79rc-qpw3-jv92

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-79rc-qpw3-jv92/GHSA-79rc-qpw3-jv92.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-79rc-qpw3-jv92

Withdrawn

2026-07-06T21:53:56Z

Published

2026-04-22T18:31:45Z

Modified

2026-09-10T03:50:43Z

Severity

3.4 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Duplicate Advisory: uutils coreutils has an Improper Preservation of Permissions issue

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-r9hw-mj3w-phcq. This link is maintained to preserve external references.

Original Description

The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs. This leaves mislabeled nodes behind with incorrect default contexts, potentially allowing unauthorized access to device nodes that should have been restricted by mandatory access controls.

Database specific

{
    "cwe_ids":  [
        "CWE-281"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-30T17:29:00Z",
    "nvd_published_at":  "2026-04-22T17:16:38Z",
    "severity":  "LOW"
}

References

Affected packages

crates.io / coreutils

Package

Name: coreutils; View open source insights on deps.dev
Purl: pkg:cargo/coreutils

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.6.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-79rc-qpw3-jv92/GHSA-79rc-qpw3-jv92.json"