Incorrect Group Calculation in uutils coreutils id Causes Access Risks

Executive Summary

The vulnerability exists in the id utility of uutils coreutils, where it incorrectly calculates the groups= section of its output.

Specifically, it uses a user's real GID instead of their effective GID to determine the group list, which can cause the output to differ from that of GNU coreutils.

Since many scripts and automated processes depend on the output of id for security-critical access control or permission decisions, this miscalculation can lead to incorrect or misleading information.

Useful 0 Not Useful 0

Impact Analysis

Because the id utility outputs incorrect group information, scripts and automated systems that rely on this output for access control or permission checks may make wrong decisions.

This can result in unauthorized access or security misconfigurations, potentially allowing users to gain permissions they should not have or causing denial of access where it is needed.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the id utility of uutils coreutils causes miscalculation of group information, which can lead to unauthorized access or security misconfigurations. Since many scripts and automated processes rely on this output for security-critical access-control or permission decisions, this discrepancy may undermine the enforcement of access controls.

Such unauthorized access or misconfigurations could potentially impact compliance with standards and regulations like GDPR or HIPAA, which require strict access controls and protection of sensitive data. However, the specific effect on compliance depends on how the affected systems use the id utility and whether this vulnerability leads to actual data exposure or unauthorized actions.

Useful 0 Not Useful 0