`kill -1` is incorrectly parsed as a positional `pid = -1`; combined with the default SIGTERM this calls `kill(-1, SIGTERM)`, signaling nearly every process the caller can see. GNU `kill` recognizes `-1`/`-9` as signals and reports "not enough arguments". ``` $ kill -1 # uutils: kill(-1, SIGTERM) -> mass termination / crash $ kill -1 # GNU: kill: not enough arguments ``` **Impact:** a user running `kill -1` mass-terminates processes, potentially crashing the system. Recommendation: parse `-N` as a signal number, and error with "not enough arguments" when no PID is given. **Remediation:** Acknowledged by Canonical; fixed in commit cae94028. --- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.70. Credit: Zellic._
Update uu_kill to 0.6.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scankill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS) affects uu_kill (rust). Severity is medium. `kill -1` is incorrectly parsed as a positional `pid = -1`; combined with the default SIGTERM this calls `kill(-1, SIGTERM)`, signaling nearly every process the caller can see. GNU `kill` recognizes `-1`/`-9` as signals and reports "not enough arguments". ``` $ kill -1 # uutils: kill(-1, SIGTERM) -> mass termination / crash $ kill -1 # GNU: kill: not enough arguments ``` **Impact:** a user running `kill -1` mass-terminates processes, potentially crashing the system. Recommendation: parse `-N` as a signal number, and error with "not enough arguments" when no PID is given. **Remediation:** Acknowledged by Canonical; fixed in commit cae94028. --- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.70. Credit: Zellic._
AI coding agents often install or upgrade packages automatically in rust. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
`kill -1` is incorrectly parsed as a positional `pid = -1`; combined with the default SIGTERM this calls `kill(-1, SIGTERM)`, signaling nearly every process the caller can see. GNU `kill` recognizes `-1`/`-9` as signals and reports "not enough arguments". ``` $ kill -1 # uutils: kill(-1, SIGTERM) -> mass termination / crash $ kill -1 # GNU: kill: not enough arguments ``` **Impact:** a user running `kill -1` mass-terminates processes, potentially crashing the system. Recommendation: parse `-N` as a signal number, and error with "not enough arguments" when no PID is given. **Remediation:** Acknowledged by Canonical; fixed in commit cae94028. --- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.70. Credit: Zellic._
Update uu_kill to 0.6.0 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scankill: 'kill -1' parsed as PID -1, sending SIGTERM to all processes (system crash / DoS) affects uu_kill (rust). Severity is medium. `kill -1` is incorrectly parsed as a positional `pid = -1`; combined with the default SIGTERM this calls `kill(-1, SIGTERM)`, signaling nearly every process the caller can see. GNU `kill` recognizes `-1`/`-9` as signals and reports "not enough arguments". ``` $ kill -1 # uutils: kill(-1, SIGTERM) -> mass termination / crash $ kill -1 # GNU: kill: not enough arguments ``` **Impact:** a user running `kill -1` mass-terminates processes, potentially crashing the system. Recommendation: parse `-N` as a signal number, and error with "not enough arguments" when no PID is given. **Remediation:** Acknowledged by Canonical; fixed in commit cae94028. --- _Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.70. Credit: Zellic._
AI coding agents often install or upgrade packages automatically in rust. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range |
|---|
| Fixed version |
|---|
| uu_killrust | <0.6.0 | 0.6.0 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Fixed version |
|---|
| uu_killrust | <0.6.0 | 0.6.0 |
|---|
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard