Summary
It was discovered that uutils coreutils mkfifo incorrectly continued
processing when a target file already existed, applying default
permissions to the existing file. A local attacker could possibly use
this issue to obtain sensitive information or modify file permissions
unexpectedly. (CVE-2026-35341)
It was discovered that uutils coreutils dd incorrectly suppressed
errors during file truncation operations. A local attacker could
possibly use this issue to cause silent data corruption.
(CVE-2026-35344)
It was discovered that uutils coreutils tail incorrectly followed
symbolic links when using the --follow=name option. A local attacker
could possibly use this issue to obtain sensitive information.
(CVE-2026-35345)
It was discovered that uutils coreutils sort crashed when processing
filenames containing non-UTF-8 bytes. A local attacker could possibly
use this issue to cause a denial of service. (CVE-2026-35348)
It was discovered that uutils coreutils cp incorrectly preserved
setuid and setgid bits when ownership changes failed. A local attacker
could possibly use this issue to gain elevated privileges.
(CVE-2026-35350)
It was discovered that uutils coreutils mv failed to preserve file
ownership when moving files across file system boundaries. A local
attacker could possibly use this issue to obtain sensitive information
or cause unintended access restrictions. (CVE-2026-35351)
It was discovered that uutils coreutils mv had a time-of-check to
time-of-use race condition in its extended attribute preservation
logic. A local attacker with write access to a directory could
possibly use this issue to modify security labels on unintended files.
(CVE-2026-35354)
It was discovered that uutils coreutils cp had a race condition in
its file creation logic, initially creating destination files with
overly permissive modes. A local attacker could possibly use this
issue to obtain sensitive information. (CVE-2026-35357)
It was discovered that uutils coreutils cp had a time-of-check to
time-of-use race condition when handling symbolic links. A local
attacker with write access to a directory could possibly use this
issue to obtain sensitive information. (CVE-2026-35359)
It was discovered that uutils coreutils touch had a time-of-check to
time-of-use race condition during file creation. A local attacker
could possibly use this issue to cause data loss. (CVE-2026-35360)
It was discovered that uutils coreutils rm failed to recognize
trailing slashes on the current directory path. A local attacker could
possibly use this issue to cause data loss. (CVE-2026-35363)
It was discovered that uutils coreutils mv had a time-of-check to
time-of-use race condition during cross-device operations. A local
attacker with write access to a directory could possibly use this
issue to overwrite arbitrary files. (CVE-2026-35364)
It was discovered that uutils coreutils nohup created its output file
with world-readable permissions. A local attacker could possibly use
this issue to obtain sensitive information. (CVE-2026-35367)
It was discovered that uutils coreutils chroot incorrectly resolved
user specifications before dropping root privileges, allowing Name
Service Switch modules to be loaded from the new root directory. A
local attacker with write access to the chroot directory could
possibly use this issue to execute arbitrary code as root.
(CVE-2026-35368)
It was discovered that uutils coreutils ln failed to process
filenames containing non-UTF-8 bytes, causing the utility to exit
with an error. A local attacker could possibly use this issue to
cause a denial of service. (CVE-2026-35373)
It was discovered that uutils coreutils split had a time-of-check to
time-of-use race condition in its input and output file validation. A
local attacker with write access to a directory could possibly use
this issue to cause data loss. (CVE-2026-35374)
It was discovered that uutils coreutils chcon had a time-of-check to
time-of-use race condition during recursive relabeling operations. A
local attacker with write access to a directory could possibly use
this issue to modify security labels on unintended files.
(CVE-2026-35376)
It was discovered that uutils coreutils env incorrectly handled
backslash sequences within single quotes when using the -S option. A
local attacker could possibly use this issue to cause a denial of
service. (CVE-2026-35377)
It was discovered that uutils coreutils install applied setuid and
setgid mode bits to destination files before completing ownership
changes. A local attacker could possibly use this issue to gain
elevated privileges. (CVE-2026-93658)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | rust-coreutils | 0.10.0-1ubuntu2~26.04.1 |
Vulnerabilities 19
-
High 7.2
uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before dropping root privileges. On glibc-based systems, this can trigg…
-
High 7.1
uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to create a FIFO because a file already exists at the target path, it fails to terminate the operation for that path and co…
-
High 7.0
uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can e…
-
Medium 6.6
uutils coreutils cp Unexpected Privileged Executable Creation with -p
The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can resu…
-
Medium 6.3
uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An …
-
Medium 6.3
uutils coreutils mv Arbitrary File Overwrite via Cross-Device TOCTOU Race Condition
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to t…
-
Medium 6.3
uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for identity between input and output files using their file paths before initiating the split operati…
-
Medium 5.6
uutils coreutils rm Safeguard Bypass via Improper Path Normalization
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, suc…
-
Medium 5.5
uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing
The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encounterin…
-
Medium 5.3
uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic…
-
Medium 4.7
uutils coreutils mv Security Xattr TOCTOU Race in Cross-Device
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for …
-
Medium 4.7
uutils coreutils cp Information Disclosure via Permission Handling Race
The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A …
-
Medium 4.7
uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swap
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without …
-
Medium 4.5
uutils coreutils chcon Security Bypass and Mandatory Access Control (MAC) Inconsistency via TOCTOU Race Condition
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during recursive operations. The implementation resolves recursive targets using a fresh path lookup (via fts_accpath) rather than binding the traversal and …
-
Medium 4.2
uutils coreutils mv Silent Ownership Loss in Cross-Device Operations
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's …
-
Low 3.3
uutils coreutils dd Silent Data Corruption via Unconditional Truncation Error Suppression
The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation attempts. While intended to mimic GNU behavior for special files like /dev/null, the uutils implementation also hides …
-
Low 3.3
uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user e…
-
Low 3.3
uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames
A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the link…
-
Low 3.3
uutils coreutils env Local Denial of Service via Improper Handling of Backslashes in Split-String Mode
A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line arguments when utilizing the -S (split-string) option. In GNU env, backslashes within single quotes are treated literally (with the exceptions of \\ and \').…
References
-
report
https://ubuntu.com/security/CVE-2026-35341
-
report
https://ubuntu.com/security/CVE-2026-35344
-
report
https://ubuntu.com/security/CVE-2026-35345
-
report
https://ubuntu.com/security/CVE-2026-35348
-
report
https://ubuntu.com/security/CVE-2026-35350
-
report
https://ubuntu.com/security/CVE-2026-35351
-
report
https://ubuntu.com/security/CVE-2026-35354
-
report
https://ubuntu.com/security/CVE-2026-35357
-
report
https://ubuntu.com/security/CVE-2026-35359
-
report
https://ubuntu.com/security/CVE-2026-35360
-
report
https://ubuntu.com/security/CVE-2026-35363
-
report
https://ubuntu.com/security/CVE-2026-35364
-
report
https://ubuntu.com/security/CVE-2026-35367
-
report
https://ubuntu.com/security/CVE-2026-35368
-
report
https://ubuntu.com/security/CVE-2026-35373
-
report
https://ubuntu.com/security/CVE-2026-35374
-
report
https://ubuntu.com/security/CVE-2026-35376
-
report
https://ubuntu.com/security/CVE-2026-35377
-
report
https://ubuntu.com/security/CVE-2026-93658