CVE-2026-35350

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/9750	Exploit Issue Tracking Vendor Advisory
https://github.com/uutils/coreutils/issues/9750	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La utilidad cp en uutils coreutils no maneja correctamente los bits setuid y setgid cuando falla la preservación de la propiedad. Al copiar con la opción -p (preservar), la utilidad aplica los bits de modo de origen incluso si la operación chown no tiene éxito. Esto puede resultar en una copia propiedad del usuario que retiene los bits privilegiados originales, creando ejecutables privilegiados inesperados que violan las políticas de seguridad locales. Esto difiere de GNU cp, que borra estos bits cuando no se puede preservar la propiedad.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35350

Mitre link : CVE-2026-35350

CVE.ORG link : CVE-2026-35350

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-281

Improper Preservation of Permissions

{"id": "CVE-2026-35350", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35350", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:56:50.879133Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:37.327", "references": [{"url": "https://github.com/uutils/coreutils/issues/9750", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/issues/9750", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-281"}]}], "descriptions": [{"lang": "en", "value": "The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved."}, {"lang": "es", "value": "La utilidad cp en uutils coreutils no maneja correctamente los bits setuid y setgid cuando falla la preservaci\u00f3n de la propiedad. Al copiar con la opci\u00f3n -p (preservar), la utilidad aplica los bits de modo de origen incluso si la operaci\u00f3n chown no tiene \u00e9xito. Esto puede resultar en una copia propiedad del usuario que retiene los bits privilegiados originales, creando ejecutables privilegiados inesperados que violan las pol\u00edticas de seguridad locales. Esto difiere de GNU cp, que borra estos bits cuando no se puede preservar la propiedad."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}