CVE-2026-35372

Executive Summary

CVE-2026-35372 is a logic error in the ln utility of the uutils coreutils project, a Rust-based reimplementation of GNU coreutils. The vulnerability allows the ln command to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. This occurs because the implementation only honored the "no-dereference" intent if the --force (overwrite) mode was also enabled. As a result, a local attacker can manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration. The CVSS score is 5.0 (Medium), with a local attack vector and low complexity. No public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed via package managers like cargo (Rust) and potentially as a system utility in some Linux distributions. The package is not an NPM, PyPI, Go, or Ruby package, but it is a critical system utility. Users should monitor for updates from the uutils project and consider using GNU coreutils as a safer alternative until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Unauthorized file creation or modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is local and requires low privileges, but it can lead to unauthorized file creation in sensitive directories, potentially aiding privilege escalation or system misconfiguration.

Deep Dive & Mechanics

The ln utility in uutils coreutils is used to create hard and symbolic links. The --no-dereference (or -n) flag is intended to treat the symbolic link itself as the destination, not the target it points to. However, due to a logic error, the implementation only checks for the --no-dereference flag when --force (overwrite) is also enabled. This means that when ln -n is used without --force, the utility follows the symbolic link to its target directory and creates new links inside that directory.

Root Cause: The code logic incorrectly prioritizes the --force flag over --no-dereference. The condition for dereferencing is inverted or missing, causing the utility to always dereference unless --force is present.

Attack Scenario: A local attacker can create a symbolic link pointing to a sensitive directory (e.g., /etc/cron.d/). When a privileged user or system script runs ln -n target_link new_link, the utility follows the symlink and creates new_link inside the sensitive directory, potentially overwriting critical files or adding malicious entries.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable ln
fn create_link(source: &Path, dest: &Path, no_deref: bool, force: bool) {
    if no_deref && force {
        // Treat symlink as destination
        symlink(source, dest);
    } else {
        // Follow symlink and create link inside target
        let target = read_link(dest);
        symlink(source, target.join(dest.file_name().unwrap()));
    }
}

Patched Code (Conceptual):

// Pseudocode for patched ln
fn create_link(source: &Path, dest: &Path, no_deref: bool, force: bool) {
    if no_deref {
        // Treat symlink as destination regardless of force
        symlink(source, dest);
    } else {
        // Follow symlink only if no_deref is false
        let target = read_link(dest);
        symlink(source, target.join(dest.file_name().unwrap()));
    }
}

The fix ensures that --no-dereference is honored independently of --force.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system with uutils coreutils installed.
• Ability to create symbolic links (standard user).

Steps:

1. Create a symbolic link pointing to a sensitive directory:

   ln -s /etc/cron.d/ target_link
   

2. Wait for a privileged user or script to run:

   ln -n target_link malicious_script
   

3. The utility follows the symlink and creates malicious_script inside /etc/cron.d/, potentially executing arbitrary code.

Proof of Concept (PoC):

# As attacker (low-privilege user)
ln -s /tmp/sensitive_dir/ target_link

# As root or privileged script
ln -n target_link new_file
# This creates /tmp/sensitive_dir/new_file instead of replacing target_link

Blue Team (Detection & Defense)

Detection:

• Monitor for ln commands with -n flag that are followed by symlink creation.
• Audit file creation in sensitive directories (e.g., /etc/cron.d/, /etc/init.d/).

Defense:

• Use GNU coreutils instead of uutils coreutils until a patch is available.
• Restrict creation of symbolic links in world-writable directories.
• Implement file integrity monitoring (FIM) for sensitive directories.

Indicators of Compromise (IOCs)

• File System Events: Unexpected file creation in directories like /etc/cron.d/, /etc/init.d/, /usr/local/bin/.
• Process Anomalies: ln processes with -n flag and arguments pointing to symlinks.
• Symlink Manipulation: New symbolic links pointing to sensitive directories created by non-privileged users.

Detection Engineering

YARA Rule

rule CVE_2026_35372_ln_no_deref {
    meta:
        description = "Detects exploitation of CVE-2026-35372 in uutils ln utility"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2026-35372"
    strings:
        $ln_cmd = "ln" nocase
        $no_deref = "-n" or "--no-dereference"
        $symlink = "->" or "symbolic link"
    condition:
        $ln_cmd and $no_deref and #symlink > 0
}

Sigma Rule

title: CVE-2026-35372 - uutils ln No-Dereference Bypass
id: cve-2026-35372
status: experimental
description: Detects ln commands with -n flag that may bypass no-dereference logic
author: Valters IT
date: 2025-04-14
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/ln'
        CommandLine|contains: '-n'
    condition: selection
falsepositives:
    - Legitimate use of ln -n with force flag
level: medium

Suricata Rule

alert syscall any any -> any any (msg:"CVE-2026-35372 - uutils ln No-Dereference Bypass"; syscall: symlink; content:"-n"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation:

• Replace uutils coreutils with GNU coreutils on affected systems.
• Restrict execution of ln with -n flag for non-privileged users via sudoers or AppArmor.

Long-term Fix:

• Apply the official patch from the uutils project once released.
• Update to a patched version of uutils coreutils (e.g., >= 0.0.27).

Workaround:

• Use ln -n -f (force mode) to ensure no-dereference behavior, but this may overwrite existing symlinks.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 82766D1FDD44F34836D3C4D9] */}