uutils coreutils CVE-2026-35349

The vulnerability requires: (1) local filesystem write access to create a symbolic link (e.g., to /tmp or the user's home directory); (2) the attacker or accidental user must invoke rm with the -r or -rf flag pointing to the crafted symlink; (3) uutils coreutils must be the installed rm binary (not GNU coreutils, which uses inode comparison). The --preserve-root flag must be active (default behavior). No authentication bypass is required - any local user can exploit this. Attack complexity is high (AC:H) because the attacker must manually construct a symlink and explicitly invoke rm against it; the vulnerability is not remotely triggerable and requires deliberate or accidental user action. Exploitation does NOT require elevated privileges (PR:N); the impact is constrained by the invoking user's file access permissions, but on single-user systems or containers, deletion of root filesystem content is catastrophic.

CVSS 6.7 (AV:L/AC:H/PR:N/UI:N) indicates local-only attack vector with high complexity, meaning the vulnerability is not trivially exploitable. SSVC framework concurs: no known exploitation, non-automatable (requires manual symlink setup), and technical impact is partial (not total compromise, though data loss is severe). The Authentication Bypass tag is potentially misleading - this is not an auth bypass but a logic bypass of a safety mechanism. Real-world risk depends on whether uutils coreutils is deployed as the system rm utility (replacing GNU coreutils); many Linux distributions ship GNU coreutils by default. If uutils is installed as a replacement, the risk is moderate because an unprivileged local user could trigger unintended filesystem destruction via a crafted symlink, but AC:H mitigates widespread exploitation. The vulnerability is less critical than raw CVSS suggests because: (1) requires local filesystem write access to create symlink, (2) AC:H indicates non-obvious exploitation path, (3) no active exploitation reported. However, in container or multi-tenant environments where uutils is the rm implementation, the risk elevates to high.

An unprivileged user with write access to /tmp creates a symbolic link: 'ln -s / /tmp/rootlink'. The user then executes 'rm -r /tmp/rootlink' with intent to recursively delete the symlink's contents (testing or malice). The vulnerable rm utility's string-based check sees /tmp/rootlink (not /) and permits recursion. The symlink resolves to /, and the entire root filesystem is deleted. In a containerized environment, this destroys the container's filesystem image; on a shared server, it impacts all users and services.