CVE-2026-35378

Executive Summary

CVE-2026-35378 is a logic error in the expr utility of the uutils coreutils project, a Rust-based reimplementation of GNU coreutils. The flaw causes parenthesized subexpressions to be evaluated during the parsing phase rather than at execution time. This prevents proper short-circuiting for logical OR (|) and AND (&) operators. Consequently, arithmetic errors (e.g., division by zero) in "dead" branches—branches that should be skipped due to short-circuit evaluation—are raised as fatal errors. This diverges from GNU expr behavior, breaking shell scripts that rely on guarded expressions and causing premature script termination.

The vulnerability has a CVSS score of 3.3 (Low) and an EPSS score of 0.0%, indicating low exploitability in the wild. However, it poses a significant reliability risk for environments using uutils coreutils as a drop-in replacement for GNU coreutils, particularly in automated shell scripting and CI/CD pipelines.

Supply Chain & Package Security

This vulnerability affects the uutils coreutils package, which is distributed via:

• Crates.io (Rust package registry) as coreutils
• GitHub repository: uutils/coreutils
• Linux distributions that package uutils (e.g., Arch Linux AUR, NixOS)

The flaw is in the expr utility, a core component of the package. Since uutils is often used as a lightweight or cross-platform alternative to GNU coreutils, any script relying on GNU-compatible expr behavior may fail silently or terminate prematurely. This can lead to:

• CI/CD pipeline failures due to unexpected script exits.
• Security monitoring gaps if scripts that guard sensitive operations (e.g., file existence checks, permission validation) are bypassed.
• Supply chain risk if the package is used in container images or embedded systems without proper testing.

CVSS Breakdown & Threat Level

Threat Level: Low. The vulnerability requires local execution and only affects availability in specific script scenarios. However, in automated environments (e.g., CI/CD, cron jobs), it can cause repeated failures.

Deep Dive & Mechanics

The expr utility evaluates arithmetic and logical expressions. In GNU expr, short-circuit evaluation is implemented: for logical OR (|), if the left operand evaluates to true (non-zero), the right operand is skipped. Similarly, for logical AND (&), if the left operand is false (zero), the right operand is skipped.

In uutils expr, the parser evaluates parenthesized subexpressions during parsing (AST construction) rather than deferring evaluation to the execution phase. This means that when a subexpression like (1 / 0) appears inside a parenthesized group, it is evaluated immediately, even if it is in a "dead" branch that should be short-circuited.

Example:

# GNU expr: returns 1 (true) because left side is true, right side is skipped
expr 1 \| \( 1 / 0 \)

# uutils expr: raises "division by zero" error because (1 / 0) is evaluated during parsing

The root cause is a design flaw in the expression parser: it recursively evaluates all subexpressions during parsing instead of building an AST and evaluating it lazily. This violates the expected semantics of short-circuit operators.

Vulnerable vs. Patched Code

Vulnerable Code (uutils expr parser):

// Simplified representation of the flawed parser
fn parse_expr(tokens: &mut TokenStream) -> Result<Expr, Error> {
    let left = parse_term(tokens)?;
    if tokens.peek() == Some(&Token::Or) {
        tokens.next();
        let right = parse_expr(tokens)?; // Evaluated immediately during parsing
        Ok(Expr::Or(Box::new(left), Box::new(right)))
    } else if tokens.peek() == Some(&Token::And) {
        tokens.next();
        let right = parse_expr(tokens)?; // Evaluated immediately during parsing
        Ok(Expr::And(Box::new(left), Box::new(right)))
    } else {
        Ok(left)
    }
}

Patched Code (Expected fix):

// Lazy evaluation using a closure or deferred evaluation
fn parse_expr(tokens: &mut TokenStream) -> Result<Expr, Error> {
    let left = parse_term(tokens)?;
    if tokens.peek() == Some(&Token::Or) {
        tokens.next();
        let right = || parse_expr(tokens); // Deferred evaluation
        Ok(Expr::Or(Box::new(left), Box::new(right)))
    } else if tokens.peek() == Some(&Token::And) {
        tokens.next();
        let right = || parse_expr(tokens); // Deferred evaluation
        Ok(Expr::And(Box::new(left), Box::new(right)))
    } else {
        Ok(left)
    }
}

The fix requires changing the parser to build an AST without evaluating subexpressions, then evaluating the AST lazily during execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• uutils coreutils installed (e.g., via cargo install coreutils or package manager)
• A shell script that uses expr with short-circuit logic

Exploitation Steps:

1. Identify scripts using expr with | or & operators and parenthesized subexpressions.
2. Craft an expression that triggers a division by zero in a dead branch:

   expr 1 \| \( 1 / 0 \)
   

3. Observe that uutils expr raises a fatal error instead of returning 1.
4. In a script, this causes premature termination:

   #!/bin/bash
   set -e
   result=$(expr 1 \| \( 1 / 0 \))
   echo "Result: $result"  # Never reached
   

Impact: Denial of service in scripts that rely on guarded expressions. Can be used to bypass security checks if the script exits before enforcing access controls.

Blue Team

Detection:

• Monitor for unexpected script exits or error messages containing "division by zero" from expr.
• Audit scripts that use expr with logical operators and parenthesized subexpressions.

Mitigation:

• Replace uutils expr with GNU expr in critical scripts.
• Use shell built-in arithmetic ($(( ... ))) instead of expr.
• Add error handling in scripts:

  result=$(expr 1 \| \( 1 / 0 \) 2>/dev/null) || result=1
  

Lab Setup:

# Install uutils coreutils
cargo install coreutils

# Test the vulnerability
uutils-expr 1 \| \( 1 / 0 \)
# Expected: error (division by zero)
# GNU expr: returns 1

Indicators of Compromise (IOCs)

• Error message: division by zero from uutils expr
• Unexpected script exit codes (non-zero) when using expr with logical operators
• Log entries: expr: arithmetic error: division by zero
• Process name: uutils-expr or coreutils expr
• File hash: SHA256 of vulnerable uutils binary (version-dependent)

Detection Engineering

YARA Rule

rule CVE_2026_35378_uutils_expr_short_circuit {
    meta:
        description = "Detects uutils expr binary with short-circuit logic error"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-35378"
    strings:
        $expr_binary = "uutils-expr" nocase
        $error_msg = "division by zero" nocase
    condition:
        $expr_binary or $error_msg
}

Sigma Rule

title: Uutils expr Short-Circuit Logic Error
id: 8a3f2c1e-5b7d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects execution of uutils expr with expressions that trigger division by zero in dead branches
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/uutils-expr'
        CommandLine|contains: '1 / 0'
    condition: selection
falsepositives:
    - Intentional testing of the vulnerability
level: low

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-35378 - Uutils expr Division by Zero"; content:"division by zero"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Replace uutils expr with GNU expr in all scripts and systems.
2. Use shell built-in arithmetic ($(( ... ))) instead of expr for integer operations.
3. Add error handling to scripts that use expr:

   result=$(expr 1 \| \( 1 / 0 \) 2>/dev/null) || result=1
   

Long-term Fix:

• Monitor the uutils repository for a patch.
• Apply the fix once available: modify the parser to defer evaluation of subexpressions until execution time.
• Consider switching to GNU coreutils for production environments.

Workaround:

• Avoid using parenthesized subexpressions with logical operators in expr.
• Use test or [ ] for boolean logic instead.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 0A1D1BDF924EF23D47C3FDF8] */}