CVE-2026-35370

Executive Summary

CVE-2026-35370 is a logic vulnerability in the id utility of the uutils coreutils project, a Rust-based reimplementation of standard Unix core utilities. The flaw causes the utility to miscalculate the groups= section of its output by using the user's real GID (R_GID) instead of their effective GID (E_GID) when computing the group list. This discrepancy from GNU coreutils behavior can lead to security misconfigurations and unauthorized access in environments where scripts and automated processes rely on id output for access-control decisions.

The vulnerability has a CVSS score of 4.4 (Medium), with an EPSS score of 0.0% indicating low exploitation probability at this time. No public proof-of-concept or exploit code is available. The patch status is unknown, and no official fix has been released.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed as a Rust crate (uutils-coreutils) and is also available via package managers for various Linux distributions. Organizations using uutils as a drop-in replacement for GNU coreutils should assess their exposure, particularly in containerized environments or CI/CD pipelines where id output is used for permission checks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a user account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not cross trust boundaries.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited integrity impact.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is not remotely exploitable and requires local access, but it can lead to privilege escalation or access control bypass in automated environments.

Deep Dive & Mechanics

The id utility in uutils coreutils is designed to display user and group information. The vulnerability lies in the group list computation logic. In standard GNU coreutils, when a user has an effective GID different from their real GID (e.g., after executing a setgid binary), the groups= field in the output includes groups associated with the effective GID. However, the uutils implementation incorrectly uses the real GID to compute this list.

Technical Root Cause:

• The code path responsible for enumerating groups calls getgrouplist() or similar system calls with the real GID instead of the effective GID.
• This results in the groups= section showing only groups where the user's real GID is a member, omitting groups accessible via the effective GID.

Impact on Security:

• Scripts that parse id output to determine group membership may incorrectly conclude that a process lacks access to certain resources.
• In containerized environments or with setgid binaries, this can lead to unauthorized access or denial of service.
• Example scenario: A setgid binary runs with effective group admin, but id reports only the user's real group users. A script checking for admin group membership would fail, potentially granting unintended access.

Vulnerable vs. Patched Code

Vulnerable Code (uutils coreutils):

// Simplified vulnerable implementation
fn get_group_list(user: &str, real_gid: u32) -> Vec<String> {
    // Uses real_gid instead of effective_gid
    let groups = get_groups_for_gid(real_gid);
    groups.iter().map(|g| g.name.clone()).collect()
}

Patched Code (Expected fix):

// Corrected implementation
fn get_group_list(user: &str, effective_gid: u32) -> Vec<String> {
    // Uses effective_gid as per GNU behavior
    let groups = get_groups_for_gid(effective_gid);
    groups.iter().map(|g| g.name.clone()).collect()
}

Key Difference: The patched version uses the effective GID (obtained via getegid()) instead of the real GID (getgid()) when computing the group list.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local user account on a system using uutils coreutils.
• A setgid binary or a process with elevated effective GID.

Exploitation Steps:

1. Identify a setgid binary that grants a privileged group (e.g., admin).
2. Execute the binary to gain effective group membership.
3. Run id and observe that the groups= field does not include the privileged group.
4. Exploit scripts that rely on id output for access control decisions.

Example:

# Assume /usr/bin/setgid_admin is setgid to group 'admin'
./setgid_admin
id
# Output shows: uid=1000(user) gid=1000(users) groups=1000(users)
# Expected: groups=1000(users),4(admin)

Blue Team

Detection:

• Monitor for discrepancies between id output and actual group membership.
• Use system auditing to track setgid binary execution and subsequent id calls.

Mitigation:

• Replace uutils coreutils with GNU coreutils in production environments.
• Implement runtime checks that verify group membership using system calls directly (e.g., getegid(), getgroups()).

Indicators of Compromise (IOCs)

• File Hashes: (None available – no known malicious binaries)
• Process Anomalies: Processes running with effective GID different from reported groups.
• Log Entries: Audit logs showing setgid execution followed by id calls.
• Network: No network indicators (local vulnerability).

Detection Engineering

YARA Rule

rule CVE_2026_35370_uutils_id_groups {
    meta:
        description = "Detects uutils coreutils id binary with group miscalculation vulnerability"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-35370"
    strings:
        $magic = { 75 74 69 6C 73 20 63 6F 72 65 75 74 69 6C 73 } // "utils coreutils"
        $gid_func = { 67 65 74 67 69 64 } // "getgid"
        $egid_func = { 67 65 74 65 67 69 64 } // "getegid"
    condition:
        $magic and $gid_func and not $egid_func
}

Sigma Rule

title: CVE-2026-35370 - uutils id Group Miscalculation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of uutils id utility with potential group miscalculation
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/id'
        CommandLine|contains: 'groups'
    condition: selection
falsepositives:
    - Legitimate use of uutils id
level: medium

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35370 - uutils id Group Miscalculation"; flow:to_server; content:"id"; nocase; content:"groups"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Replace uutils coreutils with GNU coreutils in all production environments.
2. Audit scripts that parse id output for access control decisions and implement direct system call checks.

Long-term Fix:

• Apply the official patch when released (expected to change getgid() to getegid() in the group list computation).
• Monitor the uutils GitHub repository for updates.

Workarounds:

• Use groups command instead of id for group membership checks.
• Implement wrapper scripts that call getegid() and getgroups() directly.

Detection:

• Deploy the provided YARA and Sigma rules to identify vulnerable binaries.
• Enable audit logging for setgid binary execution and id utility calls.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 5C16983BF77205B42CCD6ECB] */}