A vulnerability in uutils coreutils mkfifo permits local users to inadvertently change the permissions of existing files, creating a significant risk of sensitive data exposure.

The flaw exists in the mkfifo utility, where a failure to properly terminate the operation when a target file already exists results in an erroneous call to set_permissions. This allows a local, authenticated user to alter the permissions of critical system files to a default mode, potentially granting unauthorized access to sensitive data like SSH keys.

Successful exploitation of this vulnerability allows for the escalation of file access rights on a local system. Given the CVSS score of 7.1, this is classified as a High-severity issue, as it could lead to the exposure of cryptographic material or configuration files, potentially resulting in full system compromise or lateral movement by an attacker who has already gained local access.

Immediate Action: Monitor official uutils coreutils release channels and apply security updates as soon as they become available.

Proactive Monitoring: Review system logs for unusual file permission changes, particularly those involving sensitive directories, and audit the usage of the mkfifo utility in automated scripts.

Compensating Controls: Restrict local user access to systems where uutils coreutils is deployed and ensure that sensitive files are protected by appropriate file system permissions that are periodically audited for integrity.

Public Exploit Available: No (exploit_available: false)

While this vulnerability requires local access, the potential for sensitive information disclosure makes it a priority for remediation. Administrators should track the upstream uutils coreutils repository for patch releases and implement strict access controls on systems where this utility is utilized to minimize the local attack surface.