3.3 LOW
- CVSS version: 3.1
- Attack vector (AV): LOCAL
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): LOW
- Integrity impact (I): NONE
- Availability impact (A): NONE
Activity log
- Created suggestion
uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.
References
Affected products
Matching in nixpkgs
pkgs.coreutils
GNU Core Utilities
pkgs.coreutils-full
GNU Core Utilities
pkgs.policycoreutils
SELinux policy core utilities
pkgs.uutils-coreutils
Cross-platform Rust rewrite of the GNU coreutils
pkgs.coreutils-prefixed
GNU Core Utilities
pkgs.uutils-coreutils-noprefix
Cross-platform Rust rewrite of the GNU coreutils
pkgs.minimal-bootstrap.coreutils
The GNU Core Utilities
pkgs.selinuxPackages.policycoreutils
SELinux policy core utilities
pkgs.minimal-bootstrap.coreutils-musl
The GNU Core Utilities
pkgs.minimal-bootstrap.coreutils-static
The GNU Core Utilities
Package maintainers
-
@dasJ Janne Heß <janne@hess.ooo>
-
@mdaniels5757 Michael Daniels <nix@mdaniels.me>
-
@infinisil Silvan Mosberger <contact@infinisil.com>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@balsoft Alexander Bantyev <balsoft75@gmail.com>
-
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
-
@Gskartwii Aleksi Hannula <ahannula4@gmail.com>
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@emilytrau Emily Trau <emily+nix@downunderctf.com>
-
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
-
@Artturin Artturi N <artturin@artturin.com>
-
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
-
@RossComputerGuy Tristan Ross <tristan.ross@midstall.com>
-
@numinit Morgan Jones <me+nixpkgs@numin.it>
-
@matthiasbeyer Matthias Beyer <mail@beyermatthias.de>
-
@GaetanLepage Gaetan Lepage <gaetan@glepage.com>