uutils coreutils CVE-2026-35350

Exploitation requires the following specific conditions: the system must be running uutils coreutils with the cp command; the -p (preserve) flag must be used; the source file must have setuid or setgid bits set in its mode; the user executing cp must lack the privilege to change file ownership (chown must fail, typically when attempting to change ownership to a different user like root); and the user must have write access to the destination directory. Non-default configurations are not required - the vulnerability manifests in standard usage of cp -p on files with privilege bits. The vulnerability does NOT require file ownership changes to succeed, only that the user lack the privilege to perform them. Limitation factors: this is a local-only vulnerability (AV:L); requires at least user-level access (PR:L); and only affects systems explicitly using uutils coreutils rather than GNU coreutils as their default cp implementation.

This vulnerability presents moderate real-world risk despite a CVSS score of 6.6. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U) correctly identifies local access, low complexity, and low privilege requirements as necessary conditions. The SSVC framework indicates 'poc' exploitation status (proof-of-concept exists, not actively weaponized), 'no' automatable exploitation (requires specific directory structure and file manipulation), and 'partial' technical impact (information disclosure plus privilege escalation potential). The divergence from GNU cp behavior is notable because it suggests the vulnerability may only affect systems explicitly using uutils coreutils as a cp replacement, which is less common than systems using GNU coreutils. However, in environments where uutils is deployed (embedded systems, containers, Rust-based tooling), local privilege escalation via this mechanism becomes viable. The 'Information Disclosure' tag suggests the primary risk is unauthorized access to sensitive files marked with setuid bits. Real-world impact depends heavily on deployment context: high risk for multi-user systems where untrusted users can manipulate files in shared directories, lower risk for single-user systems or those with strict filesystem permissions. No conflict between CVSS and EPSS data is apparent; this is a genuine privilege-boundary issue that is not trivially exploitable.

An attacker with local user access on a system running uutils coreutils identifies a script or binary in a shared directory that is intended to be setuid root. The attacker copies this file using 'cp -p source dest' to a location where they have write permissions. Because the chown operation fails (the attacker lacks privilege to change ownership to root), but uutils cp still applies the original mode bits, the attacker's copy becomes a setuid binary owned by the attacker's user. The attacker then modifies this copy or arranges for a privileged process to execute it, gaining code execution in a higher privilege context.