Do Son 
TL;DR
A uutils coreutils vulnerability affects the stdbuf tool in the Rust rewrite of GNU coreutils. By default, stdbuf drops a world-writable shared library and loads it through LD_PRELOAD. On shared systems, one local user could then execute arbitrary code as another.
Why it matters
uutils coreutils ships in several Linux and BSD distributions. Researcher Collin Funk reports the flaw reaches uutils-coreutils packages on Fedora, Alpine Linux, FreeBSD, and NetBSD. These are core command-line tools, so wide reach raises the stakes.
How the attack works
GNU stdbuf loads a helper library named libstdbuf.so before a target program starts. GNU installs that library in a protected system path with correct permissions.
The uutils version behaves differently by default. It creates a world-accessible temporary directory and a world-writable libstdbuf.so inside it. It then points LD_PRELOAD at that file.
The library never gets removed, which makes the exposure easy to spot. With a permissive umask in play, another user can swap in a malicious library first. When stdbuf runs, that code loads into the process. As Funk notes in his oss-sec disclosure, this lets an attacker execute arbitrary code. He first flagged the behavior in a public GitHub comment before the wider distro impact was clear.
Affected versions
The default build of uutils coreutils is affected. No CVE has been assigned to this specific issue at the time of writing. The report confirms no in-the-wild exploitation, and no public proof-of-concept exploit is provided.
Mitigation
The fix is to build with the external library feature enabled. Maintainers should compile uutils with feat_external_libstdbuf so stdbuf uses a properly installed system library. Until then, a strict umask reduces the risk from this uutils coreutils vulnerability.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
