CVE-2026-35352

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/10020	Exploit Issue Tracking Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/04/4
http://www.openwall.com/lists/oss-security/2026/05/04/5
http://www.openwall.com/lists/oss-security/2026/05/04/6
https://github.com/uutils/coreutils/issues/10020	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una condición de carrera de tipo Time-of-Check to Time-of-Use (TOCTOU) existe en la utilidad mkfifo de uutils coreutils. La utilidad crea un FIFO y luego realiza un chmod basado en ruta para establecer permisos. Un atacante local con acceso de escritura al directorio padre puede intercambiar el FIFO recién creado por un enlace simbólico entre estas dos operaciones. Esto redirige la llamada a chmod a un archivo arbitrario, lo que podría permitir la escalada de privilegios si la utilidad se ejecuta con privilegios elevados.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35352

Mitre link : CVE-2026-35352

CVE.ORG link : CVE-2026-35352

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-35352", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35352", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T13:42:47.744415Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:37.597", "references": [{"url": "https://github.com/uutils/coreutils/issues/10020", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/04/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/04/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/04/6", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/uutils/coreutils/issues/10020", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges."}, {"lang": "es", "value": "Una condici\u00f3n de carrera de tipo Time-of-Check to Time-of-Use (TOCTOU) existe en la utilidad mkfifo de uutils coreutils. La utilidad crea un FIFO y luego realiza un chmod basado en ruta para establecer permisos. Un atacante local con acceso de escritura al directorio padre puede intercambiar el FIFO reci\u00e9n creado por un enlace simb\u00f3lico entre estas dos operaciones. Esto redirige la llamada a chmod a un archivo arbitrario, lo que podr\u00eda permitir la escalada de privilegios si la utilidad se ejecuta con privilegios elevados."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}