CVE-2026-35354

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/10014	Exploit Issue Tracking Vendor Advisory
https://github.com/uutils/coreutils/issues/10014	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de tipo Time-of-Check to Time-of-Use (TOCTOU) existe en la utilidad mv de uutils coreutils durante movimientos entre dispositivos. La lógica de preservación de atributos extendidos (xattr) utiliza múltiples llamadas al sistema basadas en rutas que realizan nuevas búsquedas de ruta a inodo para cada operación. Un atacante local con acceso de escritura al directorio puede explotar esta condición de carrera para intercambiar archivos entre llamadas, causando que el archivo de destino reciba una mezcla inconsistente de xattrs de seguridad, como etiquetas SELinux o capacidades de archivo.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35354

Mitre link : CVE-2026-35354

CVE.ORG link : CVE-2026-35354

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-35354", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35354", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:02:52.389426Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:37.867", "references": [{"url": "https://github.com/uutils/coreutils/issues/10014", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/issues/10014", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the mv utility of uutils coreutils during cross-device moves. The extended attribute (xattr) preservation logic uses multiple path-based system calls that perform fresh path-to-inode lookups for each operation. A local attacker with write access to the directory can exploit this race to swap files between calls, causing the destination file to receive an inconsistent mix of security xattrs, such as SELinux labels or file capabilities."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Time-of-Check to Time-of-Use (TOCTOU) existe en la utilidad mv de uutils coreutils durante movimientos entre dispositivos. La l\u00f3gica de preservaci\u00f3n de atributos extendidos (xattr) utiliza m\u00faltiples llamadas al sistema basadas en rutas que realizan nuevas b\u00fasquedas de ruta a inodo para cada operaci\u00f3n. Un atacante local con acceso de escritura al directorio puede explotar esta condici\u00f3n de carrera para intercambiar archivos entre llamadas, causando que el archivo de destino reciba una mezcla inconsistente de xattrs de seguridad, como etiquetas SELinux o capacidades de archivo."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}