CVE-2026-35369

Executive Summary

CVE-2026-35369 is a high-severity argument parsing vulnerability in the kill utility of the uutils coreutils project. The flaw causes the utility to misinterpret the argument -1 as a request to send the default signal (SIGTERM) to PID -1, instead of recognizing it as a signal number. Sending a signal to PID -1 results in the kernel terminating all processes visible to the caller, which can lead to a system crash or massive process termination. This behavior differs from GNU coreutils, which correctly handles -1 as a signal number and reports a missing PID argument. The vulnerability has a CVSS score of 5.5 (Medium) and is currently unpatched.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers like cargo (Rust's package manager) and potentially through Linux distribution repositories. The flaw is in the kill utility, a critical system command. An attacker with local access could exploit this to cause a denial of service (DoS) by terminating all processes visible to the user, potentially crashing the system. The supply chain risk is moderate, as the package is widely used in Rust ecosystems and some Linux distributions.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs a standard user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The vulnerability can cause a system crash or massive process termination.

Threat Level: Medium. The vulnerability requires local access but can cause significant availability impact.

Deep Dive & Mechanics

The vulnerability lies in the argument parsing logic of the kill utility in uutils coreutils. The kill command is used to send signals to processes. It accepts a signal number (e.g., -9 for SIGKILL) and a list of PIDs. In GNU coreutils, the argument -1 is correctly interpreted as a signal number (SIGTERM), and the command expects a subsequent PID argument. If no PID is provided, GNU coreutils reports an error: "missing operand."

In uutils coreutils, the argument parsing incorrectly treats -1 as a request to send the default signal (SIGTERM) to PID -1. PID -1 is a special value in Unix/Linux systems that, when used with kill(), sends the signal to all processes the caller has permission to signal (excluding the init process and the caller itself). This effectively terminates all user-visible processes, potentially crashing the system or causing a denial of service.

The root cause is a flaw in the argument parsing logic that fails to distinguish between a signal number and a PID when the argument is -1. This is a classic case of CWE-241: Improper Handling of Unexpected Data Type.

Vulnerable vs. Patched Code

Vulnerable Code (uutils coreutils):

// Simplified vulnerable logic
fn parse_kill_args(args: &[String]) -> Result<(), Error> {
    let signal = if args[0].starts_with('-') {
        // Incorrectly treats -1 as signal to PID -1
        let sig_num = args[0][1..].parse::<i32>().unwrap_or(15); // Default SIGTERM
        sig_num
    } else {
        15 // Default SIGTERM
    };
    let pid = if args.len() > 1 {
        args[1].parse::<i32>().unwrap_or(-1)
    } else {
        -1 // Incorrectly defaults to PID -1
    };
    // Sends signal to PID -1, causing mass termination
    unsafe { libc::kill(pid, signal); }
    Ok(())
}

Patched Code (GNU coreutils):

// Simplified patched logic
int parse_kill_args(int argc, char *argv[]) {
    int signal = SIGTERM;
    int pid;
    if (argc < 2) {
        fprintf(stderr, "missing operand\n");
        return 1;
    }
    if (argv[1][0] == '-') {
        signal = atoi(argv[1] + 1);
        if (argc < 3) {
            fprintf(stderr, "missing operand\n");
            return 1;
        }
        pid = atoi(argv[2]);
    } else {
        pid = atoi(argv[1]);
    }
    kill(pid, signal);
    return 0;
}

The patched code correctly checks for the presence of a PID argument after the signal number and reports an error if it is missing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system with uutils coreutils installed.
• A standard user account.

Exploitation Steps:

1. Open a terminal.
2. Run the vulnerable kill command with the -1 argument:

   kill -1
   

3. The command will send SIGTERM to PID -1, terminating all processes visible to the user.
4. This will likely cause the system to crash or become unresponsive.

Proof of Concept:

# As a regular user, run:
kill -1
# This will terminate all user processes, potentially crashing the system.

Note: No public exploit code is available for this CVE.

Blue Team (Detection & Prevention)

Detection:

• Monitor for execution of kill -1 or kill -1 <any> commands.
• Use auditd to log all kill system calls.
• Monitor for sudden mass process termination events.

Prevention:

• Restrict use of the kill command via sudoers or AppArmor/SELinux policies.
• Use a wrapper script that validates arguments before passing them to the vulnerable binary.
• Apply patches as soon as they become available.

Indicators of Compromise (IOCs)

• Command Execution: kill -1 or kill -1 <any> executed by a non-root user.
• System Logs: Sudden mass process termination events in system logs (e.g., /var/log/syslog or journalctl).
• Process Tree: A sudden drop in the number of running processes.
• Audit Logs: Audit records showing kill system calls with pid=-1 and sig=15 (SIGTERM).

Detection Engineering

YARA Rule

rule CVE_2026_35369_Kill_Argument_Parsing {
    meta:
        description = "Detects exploitation of CVE-2026-35369 in uutils coreutils kill utility"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35369"
    strings:
        $cmd1 = "kill -1" ascii wide nocase
        $cmd2 = "kill -1 " ascii wide nocase
    condition:
        any of ($cmd*)
}

Sigma Rule

title: CVE-2026-35369 - uutils kill -1 Exploitation
id: cve-2026-35369-kill-1
status: experimental
description: Detects execution of kill -1 which can cause mass process termination
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/kill'
        CommandLine|contains: ' -1'
    condition: selection
falsepositives:
    - Legitimate use by system administrators (rare)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2026-35369 - uutils kill -1 Exploitation"; content:"kill -1"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

1. Restrict Command Usage: Use sudoers to restrict the kill command to specific users or groups.
2. AppArmor/SELinux: Create policies that block the kill command from sending signals to PID -1.
3. Wrapper Script: Replace the vulnerable kill binary with a wrapper that validates arguments:

   #!/bin/bash
   if [ "$1" = "-1" ] && [ -z "$2" ]; then
       echo "Error: missing PID argument" >&2
       exit 1
   fi
   exec /path/to/real/kill "$@"
   

Long-Term Fix:

• Apply patches from the uutils coreutils project as soon as they are released.
• Monitor the project's GitHub repository for updates: https://github.com/uutils/coreutils

Workaround:

• Use GNU coreutils instead of uutils coreutils until a patch is available.

Valters IT

{/* [Security Hash: 8AC2997CC77DC3AAA4A86224] */}