CVE-2026-35371

Executive Summary

CVE-2026-35371 describes a logic flaw in the id utility of the uutils coreutils project. When the real UID and effective UID differ, the utility’s “pretty print” output incorrectly uses the effective GID instead of the effective UID for the name lookup of the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control. The vulnerability has a CVSS score of 3.3 (Low) and an EPSS score of 0.0%, indicating low exploitation likelihood. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers such as cargo (Rust’s package manager) and may be included in Linux distributions as an alternative to GNU coreutils. The flawed id utility could be used in scripts or automation that rely on accurate user identity information, potentially leading to misconfiguration or privilege escalation if combined with other vulnerabilities.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 3.3 (Low)
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – The attacker needs a low-privileged account.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – The output is misleading, potentially leading to incorrect decisions.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Low. The vulnerability requires local access and only affects the accuracy of the id utility’s output. It is unlikely to be exploited in isolation but could be used in conjunction with other vulnerabilities to mislead administrators or scripts.

Deep Dive & Mechanics

The id utility in uutils coreutils is designed to display user and group identity information. When the real UID (RUID) and effective UID (EUID) differ (e.g., when a setuid binary is executed), the utility should display both the real and effective user names. The bug occurs in the “pretty print” output path: instead of using the effective UID to look up the effective user name, the code incorrectly uses the effective GID (EGID). This means that if the effective UID and effective GID are different, the displayed effective user name will be wrong.

For example, if a process has RUID=1000 (alice), EUID=0 (root), and EGID=1000 (alice), the utility might display the effective user as “alice” instead of “root”. This could lead to scripts or administrators believing the process is running as a non-privileged user when it is actually running as root.

The root cause is a programming error in the name lookup logic, likely in the function that formats the output. The code probably retrieves the effective GID and passes it to a function that expects a UID, resulting in an incorrect name resolution.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. The fix would involve replacing the effective GID with the effective UID in the name lookup call.

Vulnerable code (pseudocode):

fn pretty_print(ruid: u32, euid: u32, rgid: u32, egid: u32) {
    let real_user = lookup_user(ruid);
    let effective_user = lookup_user(egid); // BUG: uses egid instead of euid
    // ...
}

Patched code (pseudocode):

fn pretty_print(ruid: u32, euid: u32, rgid: u32, egid: u32) {
    let real_user = lookup_user(ruid);
    let effective_user = lookup_user(euid); // FIX: uses euid
    // ...
}

Exploitation & Lab Setup

Red Team

No public exploit code is available. To demonstrate the vulnerability, an attacker with local access can create a setuid binary that changes the effective UID to root while keeping the real UID as a non-privileged user. Then, running id will show the incorrect effective user name.

Lab Setup:

1. Install uutils coreutils on a test system (e.g., via cargo install coreutils).
2. Create a simple setuid binary (e.g., in C) that sets EUID to 0 and EGID to a non-root group.
3. Execute the binary and run id to observe the misleading output.

Example C code for setuid binary:

#include <unistd.h>
#include <stdio.h>

int main() {
    setuid(0); // Set EUID to root
    setgid(1000); // Set EGID to a non-root group
    execl("/usr/bin/id", "id", NULL);
    return 0;
}

Blue Team

Detection of this vulnerability is challenging because it does not produce obvious error messages. Blue teams should:

• Monitor for unexpected use of the id command in scripts or cron jobs.
• Compare the output of id with other identity verification methods (e.g., whoami, ps aux).
• Use file integrity monitoring to detect changes to the id binary.
• Implement logging of setuid/setgid executions.

Indicators of Compromise (IOCs)

• File: The id binary from uutils coreutils (e.g., /usr/local/bin/id or /usr/bin/id if installed).
• Process: Execution of id with unexpected output (e.g., showing a non-root user when EUID is root).
• Logs: Audit logs showing setuid/setgid system calls followed by id execution.
• Network: No network indicators.

Detection Engineering

YARA Rule

rule CVE_2026_35371_uutils_id {
    meta:
        description = "Detects uutils coreutils id binary with the pretty print bug"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35371"
    strings:
        $bug_pattern = { 6c 6f 6f 6b 75 70 5f 75 73 65 72 28 65 67 69 64 29 } // lookup_user(egid)
    condition:
        $bug_pattern
}

Sigma Rule

title: Suspicious id Command Output
id: 8c9e3b2a-1f4d-4e7c-9a6b-3d2e1f0c5a7b
status: experimental
description: Detects execution of id command that may produce misleading output due to CVE-2026-35371
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/id'
        CommandLine|contains: 'uid='
    condition: selection
falsepositives:
    - Legitimate use of id command
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35371 - uutils id utility misleading output"; content:"uid="; depth:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Patch: No official patch is available. Monitor the uutils coreutils repository for updates.
• Workaround: Use GNU coreutils id instead of uutils coreutils id until a fix is released.
• Mitigation: Restrict local access to trusted users only. Use file integrity monitoring to detect changes to the id binary.
• Detection: Implement the YARA and Sigma rules above to identify the vulnerable binary and suspicious usage.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 625352657F015E18DCF6C33E] */}