uutils coreutils TOCTOU Vulnerability in Install Utility Allowing Arbitrary File Write

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the install utility of uutils coreutils, specifically in version 0.7.0. The issue arises when the -D flag is used, as the command creates parent directories and then performs a second path resolution to create the target file. Neither of these operations is anchored to a directory file descriptor, allowing an attacker with concurrent write access to replace a path component with a symbolic link. This could redirect the privileged write to an arbitrary location in the file system.

Impact

Exploitation of this vulnerability could lead to unauthorized writing of files in privileged contexts, potentially overwriting critical system files or injecting malicious payloads.

Remediation

Users can update to uutils coreutils version 0.7.0 or later, where this vulnerability has been fixed.