Skip to content

chore(deps): update rust crate uucore to 0.6.0 [security]#591

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/crate-uucore-vulnerability
Open

chore(deps): update rust crate uucore to 0.6.0 [security]#591
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/crate-uucore-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change
uucore (source) workspace.dependencies minor 0.2.2 → 0.6.0

uucore: safe_traversal TOCTOU protection only enabled on Linux

CVE-2026-35362 / GHSA-w6xc-g9qj-vp32

More information

Details

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Severity

  • CVSS Score: 3.6 / 10 (Low)
  • Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

GHSA-fqf6-gxhh-2xhw

More information

Details

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.


##### uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created

##### GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #​9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Severity

  • CVSS Score: 7.0 / 10 (High)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

uutils/coreutils (uucore)

v0.6.0

Compare Source

Rust Coreutils 0.6.0 Release:

We are happy to announce the release of Rust Coreutils 0.6.0 — a major milestone achieving 96% GNU compatibility with significant safety improvements, enhanced locale support, and extensive bug fixes!

Highlights:

  • Major GNU Compatibility Leap

    • 622 passing tests (+56 from 0.5.0), achieving 96.28% compatibility
    • Reduced failures from 55 to just 16 (-39) and skipped tests from 23 to 7 (-16)
    • Extensive test suite improvements across sort, ls, date, cksum, tail, and many more

  • Safety & Code Quality

    • Removed unsafe code from date, sort, locale.rs, and other utilities
    • Replaced raw libc calls with safe nix crate equivalents throughout
    • Enhanced error handling to avoid panics on /dev/full writes across many utilities

  • Locale & Internationalization

    • Added ICU support for locale-aware day/month names in date
    • Implemented locale-aware hour formatting and calendar support
    • Added locale-aware numeric sorting with thousand separator support in sort
    • Locale-aware collation support in join

  • Performance Improvements

    • base32/base64/basenc: Optimized with reduced memset operations
    • shuf: Optimized numeric output and added --random-seed option
    • date: Wrapped stdout in BufWriter for batch processing
    • uniq: Optimized memory usage for ignore-case comparison
    • tsort: Avoid reading entire input into memory, intern strings
    • df: Performance improvements with better filesystem handling

  • Platform Support Expansion

    • Expanded safe directory traversal to all Unix platforms
    • Enhanced Cygwin support across multiple utilities
    • Added SMACK security module support for ls, id, mkdir, mkfifo, mknod
    • Added RISC-V 64-bit musl target to CI

  • Notable Utility Improvements

    • cksum/hashsum: Merged common logic, removed deprecated hashsum binary
    • tail: Added --debug flag, fixed -F symlink tracking, fixed --pid with FIFO
    • timeout: Added comprehensive signal handling and --verbose improvements
    • sort: Legacy +POS/-POS handling, locale-aware collation, debug key annotations
    • pr: Multiple fixes for headers, form feeds, and pagination options
    • chmod: Fixed recursive handling and --preserve-root option
    • rm: Fixed error reporting and symlink handling

  • Contributions: This release was made possible by 41 new contributors joining our community

GNU Test Suite Compatibility:
Result 0.5.0 0.6.0 Change 0.5.0 to 0.6.0 % Total 0.5.0 % Total 0.6.0 % Change 0.5.0 to 0.6.0
Pass 566 622 +56 87.75% 96.28% +8.53%
Skip 23 7 -16 3.57% 1.08% -2.49%
Fail 55 16 -39 8.53% 2.48% -6.05%
Error 1 1 0 0.16% 0.15% ~0%
Total 645 646 +1 (new test)

GNU testsuite evolution

Call to Action:

Help us translate - Contribute translations at Weblate
Sponsor us on GitHub to accelerate development: github.com/sponsors/uutils

What's Changed

arch

base64

basename

cat

chgrp

chmod

chroot

cksum

comm

cp

csplit

date

dd

df

dir

dirname

du

echo

env

expand

expr

fmt

fold

groups

hashsum

head

hostid

id

install

join

kill

ln

logname

ls

mkdir

mkfifo

mknod

mktemp

more

mv

nice

nl

nohup

nproc

numfmt

pr

printenv

printf

ptx

readlink

rm

rmdir

runcon

seq

shred

shuf

sort

split

  • Added error when attempting to create file that already exists as directory by @​max-amb in #​9945

stat

stdbuf

stty

sync

tac

tail

tee

test

timeout

touch

truncate

tsort

uname

unexpand

uniq

uptime

users

wc

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/crate-uucore-vulnerability branch from a8aa53e to 2f2bcc0 Compare July 21, 2026 02:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants