Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

uu_mknod

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.4crates.ioPublished

    mknod: Device nodes created mislabeled on SELinux, with broken cleanup (remove_dir on a node)

    CVE-2026-35361 · GHSA-r9hw-mj3w-phcq

    Affected
    • crates.io uu_mknod < 0.6.0
    Fixed in
    0.6.0· Vendor fix available
    Issue
    uutils calls mknod before setting the SELinux context (GNU uses setfscreatecon first, labeling atomically). If setselinuxsecuritycontext fails, cleanup uses std::fs::removedir, which cannot remove device nodes or FIFOs, leaving the mislabeled node behind. Impact: on SELinux-enforcing systems the node is created with the wrong context; the command reports failure but leaves a mislabeled device node that may bypass mandatory access control, and orphaned nodes can persist across reboots. Recommendation: use setfscreatecon before mknod, abort on failure, and use removefile for cleanup. Remediation: Acknowledged by Canonical. --- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.58. Credit: Zellic.

    Recommended action: Upgrade to 0.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →