CVE-2026-35367

Executive Summary

CVE-2026-35367 is a local information disclosure vulnerability in the nohup utility of the uutils coreutils project. The flaw arises because the utility creates its default output file, nohup.out, without specifying explicit restricted permissions. Instead, it inherits the system's umask, which typically results in world-readable permissions (0644). In multi-user environments, this allows any local user to read the captured stdout/stderr output of commands run by other users, potentially exposing sensitive data such as passwords, API keys, or confidential logs. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions. The vulnerability has a low CVSS score of 3.3 due to the requirement for local access and the need for sensitive data to be present in the output. A patch is available in uutils coreutils version 0.0.29.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of standard Unix utilities. It is distributed via package managers like cargo (crates.io) and may be included in Linux distributions as an alternative to GNU coreutils. Users who have installed uutils coreutils via cargo install coreutils or as a system package are affected. The supply chain risk is low, as the fix is straightforward and the package is not widely deployed in critical infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed beyond the victim running nohup.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited exposure of output data.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. Exploitation requires local access and the presence of sensitive data in the output. The EPSS score is 0.0%, indicating no active exploitation in the wild.

Deep Dive & Mechanics

The nohup utility is used to run commands that ignore the SIGHUP signal and continue running after the user logs out. When stdout/stderr is not redirected, nohup writes output to a file named nohup.out in the current working directory. In GNU coreutils, this file is created with permissions 0600 (owner-only read/write) using the open() system call with explicit mode flags. In uutils coreutils, the file is created using File::create() or similar Rust standard library functions that do not specify explicit permissions, causing the file to inherit the process's umask. The default umask on most systems is 022, resulting in permissions 0644 (world-readable). This means any user on the system can read the nohup.out file if it is in a shared directory (e.g., /tmp or a world-readable home directory).

The vulnerability is classified as CWE-276 (Incorrect Default Permissions). The fix involves explicitly setting the file permissions to 0600 when creating nohup.out.

Vulnerable vs. Patched Code

Vulnerable Code (uutils coreutils < 0.0.29):

// Simplified example
use std::fs::File;
use std::io::Write;

fn main() {
    let mut file = File::create("nohup.out").unwrap(); // Inherits umask
    file.write_all(b"output data").unwrap();
}

Patched Code (uutils coreutils >= 0.0.29):

// Simplified example
use std::fs::File;
use std::io::Write;
use std::os::unix::fs::OpenOptionsExt;

fn main() {
    let mut file = std::fs::OpenOptions::new()
        .write(true)
        .create(true)
        .truncate(true)
        .mode(0o600) // Explicitly set permissions to 0600
        .open("nohup.out")
        .unwrap();
    file.write_all(b"output data").unwrap();
}

The patch adds the .mode(0o600) call to ensure the file is created with owner-only permissions, regardless of the umask.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Local access to a system with uutils coreutils installed (version < 0.0.29).
• A victim user runs a command with nohup that outputs sensitive data.

Steps:

1. Victim runs: nohup some_command_with_secrets
2. Attacker lists files in the victim's directory: ls -la nohup.out
3. Attacker reads the file: cat nohup.out

Example:

# Victim (user1)
nohup echo "password=supersecret" &
# Attacker (user2)
cat /home/user1/nohup.out
# Output: password=supersecret

Blue Team (Defense & Detection)

Detection:

• Monitor for nohup.out files with permissions other than 0600.
• Use file integrity monitoring (FIM) to alert on creation of nohup.out with world-readable permissions.

Prevention:

• Apply the patch by updating to uutils coreutils >= 0.0.29.
• Set a restrictive umask (e.g., 077) in system-wide profiles.
• Use umask 077 before running nohup as a workaround.

Workaround:

umask 077
nohup command

Indicators of Compromise (IOCs)

• File: nohup.out with permissions 0644 or other world-readable permissions.
• Process: nohup command execution without explicit umask setting.
• Log: Syslog or auditd events showing creation of nohup.out with insecure permissions.

Detection Engineering

YARA Rule

rule CVE_2026_35367_nohup_out_permissions {
    meta:
        description = "Detects nohup.out files with world-readable permissions"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-35367"
    strings:
        $header = "nohup.out"
    condition:
        $header and (uint16(0) & 0x1FF) == 0x1A4 // 0644 in octal
}

Sigma Rule

title: CVE-2026-35367 - Insecure nohup.out Permissions
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of nohup.out with world-readable permissions
author: Valters IT
date: 2026-01-01
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: 'nohup.out'
        TargetFilename|contains: '/'
    condition: selection
falsepositives:
    - Intentional creation by administrator
level: medium

Suricata Rule

alert file any any -> any any (msg:"CVE-2026-35367 - nohup.out created with insecure permissions"; file.name:"nohup.out"; file.magic:"ASCII text"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Update uutils coreutils to version 0.0.29 or later.
• As a workaround, set umask 077 before running nohup.

Long-term:

• Implement file integrity monitoring for sensitive output files.
• Educate users to redirect output to a secure location: nohup command > /path/to/secure/file 2>&1 &
• Consider using GNU coreutils instead of uutils coreutils in multi-user environments.

Patch Details:

• Fixed in commit: https://github.com/uutils/coreutils/commit/abc123 (example)
• Version: 0.0.29

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: E0798631CEF402399BCC74F4] */}