Logic Error in uutils coreutils ln Causes Symlink Dereference

Executive Summary

This vulnerability is a logic error in the ln utility of uutils coreutils. It causes the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. Normally, the --no-dereference flag should prevent ln from following symbolic links, but due to this flaw, ln only respects this flag if the --force (overwrite) mode is also enabled.

As a result, ln follows a symbolic link that points to a directory and creates new links inside that target directory instead of treating the symbolic link itself as the destination.

This means that if a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the ln utility allows unintended dereferencing of symbolic links, which can lead to unauthorized file creation or system misconfiguration by local attackers. This behavior could potentially impact compliance with standards and regulations such as GDPR or HIPAA, which require strict controls over data integrity and access to sensitive information.

Specifically, if an attacker exploits this flaw to redirect file creation into sensitive directories, it may result in unauthorized modification or insertion of files, violating principles of data integrity and security mandated by these regulations.

However, the provided information does not explicitly detail the direct compliance impact or mention any regulatory assessments.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves verifying whether the ln utility in uutils coreutils improperly dereferences symbolic links when the --no-dereference (or -n) flag is used without the --force flag.

You can test this behavior by creating a symbolic link to a directory and then using the ln command with the --no-dereference flag to see if it creates links inside the target directory instead of treating the symlink itself as the destination.

• Create a directory and a symbolic link pointing to it: mkdir /tmp/target_dir; ln -s /tmp/target_dir /tmp/symlink_dir
• Run the ln command with the --no-dereference flag to create a new link: ln -n /tmp/source_file /tmp/symlink_dir/new_link
• Check if the new link was created inside /tmp/target_dir (vulnerable behavior) or if it treated /tmp/symlink_dir as the link destination (correct behavior).

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update the uutils coreutils package to a version that includes the fix for the ln utility's --no-dereference flag behavior.

The fix was merged on March 11, 2026, ensuring that ln properly respects the --no-dereference flag and does not dereference symbolic links unintentionally.

Until the update is applied, avoid using ln with the --no-dereference flag in privileged scripts or environments where symbolic links could be manipulated by local attackers.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a local attacker to cause unauthorized file creation or system misconfiguration by manipulating symbolic links.

Specifically, because ln may follow a symbolic link and create new links inside the linked directory instead of the symlink itself, attackers can redirect file creation into sensitive directories.

This could lead to security issues such as unauthorized modification of system files or configuration, potentially compromising system integrity.

Useful 0 Not Useful 0