The sort utility in uutils coreutils is vulnerable to a process panic when using the –files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.
Weakness
An exception is thrown from a function, but it is not caught.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Coreutils | Uutils | - (including) | - (including) |
| Rust-coreutils | Ubuntu | devel | * |
| Rust-coreutils | Ubuntu | esm-apps/noble | * |
| Rust-coreutils | Ubuntu | noble | * |
| Rust-coreutils | Ubuntu | questing | * |
| Rust-coreutils | Ubuntu | resolute | * |
| Rust-coreutils | Ubuntu | upstream | * |