AIKIDO-2026-510590
coreutils is vulnerable to Improper Preservation of Permissions
33
Low Risk
This Affects:
coreutilsTL;DR
When mv falls back to a cross-device copy (after rename(2) returns EXDEV), it best-effort preserves source ownership and then applies the full source mode, including setuid/setgid bits (0o6000). If ownership cannot be preserved — for example when an unprivileged user moves a root-owned setuid/setgid file across a filesystem boundary — the destination remains owned by the mover but still carries those bits. GNU mv and fixed uutils cp strip setuid/setgid in that case. The fix tracks whether ownership was actually preserved and masks 0o6000 from the applied mode when it was not.
Who does this affect?
You are affected if you are using a version within the vulnerable range and you run mv to move a setuid or setgid file across a filesystem boundary when the mover cannot preserve the source ownership.
Background info
coreutils is vulnerable to Improper Preservation of Permissions in versions 0.0.1 - 0.9.0.
How to fix this
Upgrade the coreutils library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.