CVE-2026-6434
Description
A flaw was found in rust-coreutils. The uu_sort utility creates temporary files with insecure permissions (readable and writable by all local users) when performing external sorting. Additionally, these temporary files are not reliably removed if the uu_sort program terminates unexpectedly due to certain signals. This can lead to information disclosure, allowing other local users to read sensitive data that was processed by uu_sort. It could also enable local attackers to exhaust disk space or manipulate the output of the uu_sort command.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate the risk of information disclosure and manipulation, users can configure the `TMPDIR` environment variable to point to a securely permissioned directory before executing `uu_sort`. This ensures that temporary files are created in a location with restricted access. For example:
bashEnsure that `/path/to/secure/tmp` is a directory with appropriate permissions (e.g., `0700`) and sufficient disk space.
export TMPDIR=/path/to/secure/tmp
uu_sort [options] [file]
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
If the temporary file can be read by the attacker, sensitive information may be in that file which could be revealed.
Authorization,Other
Technical Impact: Other
If that file can be written to by the attacker, the file might be moved into a place to which the attacker does not have access. This will allow the attacker to gain selective resource access-control privileges.
Integrity,Other
Technical Impact: Other
Depending on the data stored in the temporary file, there is the potential for an attacker to gain an additional input vector which is trusted as non-malicious. It may be possible to make arbitrary changes to data structures, user information, or even process ownership.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
