CVE-2026-35367

The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.

CVSS v3 3.3 LOW

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/10021	Exploit Issue Tracking Vendor Advisory
https://github.com/uutils/coreutils/issues/10021	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) La utilidad nohup en uutils coreutils crea su archivo de salida predeterminado, nohup.out, sin especificar permisos restringidos explícitos. Esto hace que el archivo herede permisos basados en umask, lo que típicamente resulta en un archivo legible por todos (0644). En entornos multiusuario, esto permite a cualquier usuario del sistema leer la salida capturada de stdout/stderr de un comando, exponiendo potencialmente información sensible. Este comportamiento difiere de GNU coreutils, que crea nohup.out con permisos solo para el propietario (0600).

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35367

Mitre link : CVE-2026-35367

CVE.ORG link : CVE-2026-35367

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-732

Incorrect Permission Assignment for Critical Resource

{"id": "CVE-2026-35367", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35367", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:49:25.757880Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:40.423", "references": [{"url": "https://github.com/uutils/coreutils/issues/10021", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/issues/10021", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions."}, {"lang": "es", "value": "La utilidad nohup en uutils coreutils crea su archivo de salida predeterminado, nohup.out, sin especificar permisos restringidos expl\u00edcitos. Esto hace que el archivo herede permisos basados en umask, lo que t\u00edpicamente resulta en un archivo legible por todos (0644). En entornos multiusuario, esto permite a cualquier usuario del sistema leer la salida capturada de stdout/stderr de un comando, exponiendo potencialmente informaci\u00f3n sensible. Este comportamiento difiere de GNU coreutils, que crea nohup.out con permisos solo para el propietario (0600)."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}