uutils coreutils CVE-2026-35352

Exploitation requires mkfifo utility executed with elevated privileges (root or SUID context) on filesystem paths where the attacker has write access to the parent directory. Attacker must possess low-privilege local user account (PR:L) and ability to monitor filesystem events or repeatedly attempt race condition timing. Target directory must allow the attacker to perform unlink and symlink operations between FIFO creation and chmod execution - typically /tmp, /var/tmp, or user-writable shared directories. High attack complexity (AC:H) stems from TOCTOU race timing: attacker must detect FIFO creation and perform symlink swap within microseconds-to-milliseconds window before chmod executes. Exploitation limited to systems using uutils coreutils implementation rather than GNU coreutils. No user interaction required (UI:N). Most impactful when automated privileged processes invoke mkfifo on predictable paths in attacker-writable locations; minimal impact when users run mkfifo only within their own private directories with their own privilege level.

Real-world risk is moderate to high depending on deployment context. CVSS 7.0 (AV:L/AC:H/PR:L) indicates local-only exploitation with high attack complexity due to race condition timing requirements. SSVC assessment confirms proof-of-concept availability and total technical impact (privilege escalation to full system control), but marks exploitation as not automatable due to timing dependencies. The attack requires: (1) local user access with write permissions to the directory where mkfifo is invoked, (2) ability to win a race condition, and (3) the utility running with elevated privileges for meaningful impact. Risk is elevated in scenarios where system scripts or privileged processes invoke mkfifo on user-writable paths (temp directories, user home directories). Conversely, risk is minimal if mkfifo is only used by unprivileged users in their own contexts. Not listed in CISA KEV, suggesting no widespread active exploitation. The high attack complexity (AC:H) and requirement for precise timing make this difficult to exploit reliably in practice, though proof-of-concept existence lowers the barrier. Primary risk is to systems using uutils coreutils in privileged automation rather than individual user contexts.

A local attacker with low-privilege shell access identifies an automated system maintenance script running as root that uses uutils mkfifo to create a FIFO in /tmp for inter-process communication. The attacker writes a monitoring program that watches /tmp for new FIFO creation using inotify. When the script creates /tmp/process.fifo, the attacker's program immediately unlinks it and creates a symbolic link at /tmp/process.fifo pointing to /etc/shadow. The script's subsequent chmod 0666 /tmp/process.fifo follows the symlink, making /etc/shadow world-writable. The attacker then modifies /etc/shadow to add a passwordless root account or crack existing password hashes offline, achieving full system compromise. Success depends on winning the race between FIFO creation and chmod execution, typically requiring multiple attempts or system load conditions that widen the timing window. Proof-of-concept code exists per SSVC data, lowering technical barriers for skilled attackers.