uutils coreutils CVE-2026-35364

Exploitation requires write access to the destination directory where the mv operation targets a file. The attacker must trigger or predict a move operation that removes a file at a known path in a writable directory, then inject a symbolic link at that path before the subsequent copy operation recreates it. The vulnerability is triggered only during cross-device move operations (moves between different filesystems where atomic rename fails), which is a non-default scenario-moves within the same filesystem use the kernel's atomic rename and are not vulnerable. If the mv command is run with elevated privileges (e.g., via sudo or as part of a privileged process), the injected symlink allows the attacker to write to files normally protected from their permission level. The attack is not automatable due to the race condition requiring precise timing; however, high-frequency retry loops make exploitation practical in many real-world scenarios, particularly if the destination directory is frequently accessed.

The CVSS score of 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) reflects medium risk with local attack vector, high complexity, and low privilege requirements. The SSVC framework indicates exploitation is possible (poc available), not automatable (requires precise timing and write access to specific directory), and delivers partial technical impact (file overwrite within scope). The mismatch between 'Information Disclosure' tag and CVSS vector (which shows no confidentiality impact but high integrity/availability) suggests the tag may be outdated or misclassified. Real-world risk is MODERATE: exploitation requires local access, coordination of timing (high complexity), and write permissions to a specific directory-not a network-exploitable flaw. However, for systems where mv is run with elevated privileges (via sudo or setuid) and user-writable directories contain target paths, this becomes a local privilege escalation vector. The lack of active exploitation (KEV not listed) and the high complexity requirement limit urgency, but the vulnerability is valid and reproducible. Priority depends on deployment context: low for typical single-user systems, higher for multi-user systems or privilege-escalation chains.

An attacker on a multi-user system observes that an administrator runs 'sudo mv /tmp/largefile /var/important/newfile' to move a file to a system directory where the attacker lacks write access. The attacker writes a script that continuously creates and deletes a symbolic link at '/var/important/newfile' pointing to a sensitive system file (e.g., '/etc/passwd'). When the timing aligns and the symlink exists at the moment the privileged copy operation tries to recreate the destination, the mv command follows the symlink and overwrites the target file with contents from '/tmp/largefile', corrupting system configuration or enabling further privilege escalation.